Reboot ASA 8.4 (asdm 6.4) Active/Standby pair

snallncmec — Mon, 11 Mar 2019 22:46:17 GMT

Hi,

I manage a pair of ASAs (8.4 asdm 6.4) and am having trouble with traffic going thru a tunnel. It was recommended to me that perhaps a reboot is in order. I found the instructions at http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/admin_swconfig.html#wp1355970 (which I followed without actually upgrading the IOS, as all I wanted was both devices to reboot - one at at time without causing connection resets) but when I attempted it, the device that rebooted was always the same IP. My question is at step 3 "when standby unit has finished reloading and is in the Standby Ready state, force the active unit to fail over to the standby unit by entering the following command on the active unit.

active# no failover active

But there is a note "Use show failover command to verify that the standby unit is in the standby ready state" which I did.

This is the result of show failover from the 0.5 (primary) unit BEFORE issuing no failover active:

Last Failover at: 05:32:10 EST Feb 9 2012

This host: Primary - Active

Active time: 3732124 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.4(3)) status (Up Sys)

Interface management (192.168.200.249): No Link (Not-Monitored)

Interface outside (63.146.180.5): Normal (Monitored)

Interface inside (172.16.0.5): Normal (Monitored)

Interface DBDMZ (192.168.60.5): Normal (Monitored)

Interface WEBDMZ (192.168.50.5): Normal (Monitored)

slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Other host: Secondary - Standby Ready

Active time: 0 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.4(3)) status (Up Sys)

Interface management (0.0.0.0): Normal (Not-Monitored)

Interface outside (63.146.180.6): Normal (Monitored)

Interface inside (172.16.0.6): Normal (Monitored)

Interface DBDMZ (192.168.60.6): Normal (Monitored)

Interface WEBDMZ (192.168.50.6): Normal (Monitored)

slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

So far so good. Then I entered (on the PRIMARY-ACTIVE unit) the command no failover active and I got the following:

NMEC-ASA5510-COLOVA# sho failover

Failover On

Failover unit Secondary

Failover LAN Interface: failover Ethernet0/0 (up)

Unit Poll frequency 500 milliseconds, holdtime 3 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 4 of 110 maximum

Version: Ours 8.4(3), Mate 8.4(3)

Last Failover at: 11:02:26 EDT Mar 23 2012

This host: Secondary - Active

Active time: 140 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.4(3)) status (Up Sys)

Interface management (192.168.200.249): No Link (Not-Monitored)

Interface outside (63.146.180.5): Normal (Monitored)

Interface inside (172.16.0.5): Normal (Monitored)

Interface DBDMZ (192.168.60.5): Normal (Monitored)

Interface WEBDMZ (192.168.50.5): Normal (Monitored)

slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Other host: Primary - Standby Ready

Active time: 3732178 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.4(3)) status (Up Sys)

Interface management (0.0.0.0): Normal (Not-Monitored)

Interface outside (63.146.180.6): Normal (Monitored)

Interface inside (172.16.0.6): Normal (Monitored)

Interface DBDMZ (192.168.60.6): Normal (Monitored)

Interface WEBDMZ (192.168.50.6): Normal (Monitored)

slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Thinking all was well, I now issued (from the same 172.16.0.5 unit) the reload command. Unfortunately my continuous pings to .0.5 and .0.6 show that 0.6 rebooted AGAIN!?!

Can someone tell me what I am doing wrong?

Thanks,

Sue

Reboot ASA 8.4 (asdm 6.4) Active/Standby pair

patrick.preuss — Sat, 24 Mar 2012 21:36:35 GMT

Hi Sue

your ip are bound to the state active and standby. so the ip is traveling.

and the pings to .6 then must fail.

To have an eye on it you can configure management interfaces / or a special sub interfaces and do not add them to the failover. the ip then os bound to the primary / secondray unit ...

HTH

Patrick

Reboot ASA 8.4 (asdm 6.4) Active/Standby pair

snallncmec — Mon, 26 Mar 2012 11:46:53 GMT

I guessed that might be the case, but am still unsure. The IP I was pinging was the inside LAN interface (Eth

LAN failover is configured using Eth0/0 (IPs 10.0.254.253 and .254) and State Failover with Eth0/1 (IPs 10.0.253.253 and .254) "Inside" is Gig1/1 with IP 172.16.0.5 (and .6 on the second unit) I would have expected either the LAN failover or the State failover IPs to change but not the LAN interface. But perhaps I've got it backwards. Thanks for your response. Patrick.

Sue

topic Reboot ASA 8.4 (asdm 6.4) Active/Standby pair in Network Security

Reboot ASA 8.4 (asdm 6.4) Active/Standby pair

Reboot ASA 8.4 (asdm 6.4) Active/Standby pair

Reboot ASA 8.4 (asdm 6.4) Active/Standby pair