topic ASA interfaces bounced due to a wr mem in Network Security

ASA interfaces bounced due to a wr mem

mortojjesse — Mon, 11 Mar 2019 21:28:14 GMT

One line of an ACL was changed on an ASA 5520 (primary) and a wr mem was issued to save the change. It appears that when the wr mem was executed, the interfaced on the standby ASA bounced.

Can someone help me to understand why this would've happened? Configurations have been saved in the past without the result of what's in the log entry..

Thank you.

ADC-5520-MGMT-FW01/stby# show log
Syslog logging: enabled
    Facility: 22
    Timestamp logging: enabled
    Standby logging: enabled
    Debug-trace logging: disabled
    Console logging: level errors, 1203060 messages logged
    Monitor logging: level errors, 1203060 messages logged
    Buffer logging: level errors, 17590658 messages logged
    Trap logging: level informational, facility 22, 450126258 messages logged
        Logging to management 10.5.3.214
        Logging to management 10.142.20.214
        Logging to management 10.218.3.31
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: level informational, 464351755 messages logged
Sep 21 2011 17:35:29: %ASA-1-709006: (Primary) End Configuration Replication (STB)
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface management
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface staff-outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface Cert-outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface QA-outside
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface management waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface staff-outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface Cert-outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface QA-outside waiting
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface management normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface staff-outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface Cert-outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface QA-outside normal
ADC-5520-MGMT-FW01/stby#    show clock
17:50:25.768 CDT Wed Sep 21 2011

DC-5520-MGMT-FW01/act# show log

Syslog logging: enabled

Facility: 22

Timestamp logging: enabled

Standby logging: enabled

Debug-trace logging: disabled

Console logging: level errors, 1787 messages logged

Monitor logging: level errors, 1787 messages logged

Buffer logging: level errors, 6894376 messages logged

Trap logging: level informational, facility 22, 258217070 messages logged

Logging to management 10.5.3.214 errors: 85753 dropped: 603267

Logging to management 10.142.20.214 errors: 43120 dropped: 682789

Logging to management 10.218.3.31 errors: 8 dropped: 368

History logging: disabled

Device ID: disabled

Mail logging: disabled

ASDM logging: level informational, 258220730 messages logged

Sep 21 2011 17:35:18: %ASA-1-709003: (Secondary) Beginning configuration replication: Send to mate.

Sep 21 2011 17:35:30: %ASA-1-709004: (Secondary) End Configuration Replication (ACT)

ASA interfaces bounced due to a wr mem

Julio Carvajal — Thu, 22 Sep 2011 00:29:09 GMT

Hello Jesse,

Was this a Write memory or a Write Standby??

Regards,

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 00:34:27 GMT

Thank you for your reply. Yes it was a wr mem.

thank you

ASA interfaces bounced due to a wr mem

Julio Carvajal — Thu, 22 Sep 2011 00:46:47 GMT

Just to let you know it is expected that when you issue the command Write Standby that the failover or the stateful interface is going to start bouncing. this because the Primary ASA is going to replicate the entire configuration on the Stand by Unit, so while the Stand by unit is being configured you are going to have the interface down. So you dont have to worry about it.

That is why Cisco recommends to use the command write memory instead of the Write stand by, with the Write memory you are not goint to have this issue and you are going to have the replication on the stand by as well.

This is why I asked you if you performed a Write Standby, but you did not.

-Now is this the first time this happen??

-Can you issue the command again and let me know if you receive the same log?

-Can you place the output of the Show failover , Sh failover statistics

Regards,

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 01:01:42 GMT

Yes. This appears to be the first time this has happened. Is a wr stanby executed when executing a wr mem? Is that how the primary's config written to the standby? I'm thinking not. Otherwise we would see the interfaces flap everytime we write the config.

I can't execute a wr mem again as this is a production device and I am out of my change window. The interfaces are up and everything is operational. I am just confused as to why the interfaces on the standby bounced.

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 01:04:30 GMT

ADC-5520-MGMT-FW01/act# sh failover statistics

tx:79087953

        rx:100398444 ADC-5520-MGMT-FW01/act# sh failover statistics
        tx:79087953
        rx:100398444

ADC-5520-MGMT-FW01/act# sh failover
Failover On
Failover unit Secondary
Failover LAN Interface: failover GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 5 of 250 maximum
Version: Ours 8.2(1), Mate 8.2(1)
Last Failover at: 18:28:49 CDT Jul 16 2011
        This host: Secondary - Active
                Active time: 5802139 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.13): Normal
                  Interface outside (10.180.3.1): Normal
                  Interface staff-outside (10.143.27.1): Normal
                  Interface QA-outside (10.129.14.1): Normal
                  Interface Cert-outside (10.132.36.1): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
        Other host: Primary - Standby Ready
                Active time: 39994111 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.14): Normal
                  Interface outside (10.180.3.2): Normal
                  Interface staff-outside (10.143.27.2): Normal
                  Interface QA-outside (10.129.14.2): Normal
                  Interface Cert-outside (10.132.36.2): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Stateful Failover Logical Update Statistics
        Link : failover GigabitEthernet0/3 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         173722393 0          441763955 1538
        sys cmd         6106312    0          6106311    0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        35820590   0          142079651 768
        UDP conn        126262857 0          272428431 563
        ARP tbl         5532634    0          21149562   207
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       59      481762820
        Xmit Q:         0       1024    179527426

ASA interfaces bounced due to a wr mem

Julio Carvajal — Thu, 22 Sep 2011 01:07:54 GMT

You replicate the whole configuration to a stand by device with the Write standby, but afterwards by just executing the Write Memory you are going to have both devices synchronized.

The only way you will see them flapping will be with the Write Standby not with the Write Mem as I explained before.

Can you share the Show failover Statistics?

Regards,

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 01:09:46 GMT

This output from the standby:

ADC-5520-MGMT-FW01/stby# sh failover statistics
        tx:100399359
        rx:79088201
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: failover GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 5 of 250 maximum
Version: Ours 8.2(1), Mate 8.2(1)
Last Failover at: 18:28:46 CDT Jul 16 2011
        This host: Primary - Standby Ready
                Active time: 39994111 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.14): Normal
                  Interface outside (10.180.3.2): Normal
                  Interface staff-outside (10.143.27.2): Normal
                  Interface Cert-outside (10.132.36.2): Normal
                  Interface QA-outside (10.129.14.2): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
        Other host: Secondary - Active
                Active time: 5802537 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.13): Normal
                  Interface outside (10.180.3.1): Normal
                  Interface staff-outside (10.143.27.1): Normal
                  Interface Cert-outside (10.132.36.1): Normal
                  Interface QA-outside (10.129.14.1): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Stateful Failover Logical Update Statistics
        Link : failover GigabitEthernet0/3 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         931683832 4          97293586   670
        sys cmd         6106366    0          6106364    0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        144282242 0          35540883   311
        UDP conn        760145434 0          50113517   174
        ARP tbl         21149790   4          5532822    185
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       50      103099200
        Xmit Q:         0       1024    971682964

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 01:12:51 GMT

Thank you.

Here are the show fail stati

From the Active ASA
ADC-5520-MGMT-FW01/act# sh failover statistics

tx:79087953

        rx:100398444 ADC-5520-MGMT-FW01/act# sh failover statistics
        tx:79087953
        rx:100398444

From the Primary ASA
ADC-5520-MGMT-FW01/stby# sh failover statistics
tx:100399359
rx:79088201

Re: ASA interfaces bounced due to a wr mem

Julio Carvajal — Thu, 22 Sep 2011 01:17:24 GMT

Maybe it was because because the configuration was replicated to the Standby Unit and while the Active unit was writting this configuration, the failover interface went down for one or 2 seconds, but this is nothing to worry about it.

If you keep having these errors there is a workaround and that is if you have a switch between the failover units to configure the ports connected to the ASA units as Switchport Portfast, so they come up faster when a replication is made.

Hope this Help you.

Regards,

Julio

ASA interfaces bounced due to a wr mem

mortojjesse — Thu, 22 Sep 2011 01:20:46 GMT

Thank you. And thank you for taking the time to work on my question. During my next change window, I am going to replicate the event.

Your time is greatly appreciated.

Jesse

Re: ASA interfaces bounced due to a wr mem

Julio Carvajal — Thu, 22 Sep 2011 01:21:48 GMT

Hello Jesse,

It is my pleasure, any other question you have just let me know. I will be more than glad to help you

Have a great day,

Julio