topic interface down of ASA standby unit after "wr standby" command in Network Security

interface down of ASA standby unit after "wr standby" command

jjim7610 — Mon, 11 Mar 2019 21:13:01 GMT

ASA operating as single context & Active/Standby mode.

ASA os upgraded to 8.3(2) recently.

whenever replicate the configuration of active unit to standby, the interface of the standby unit is down, and up (flap).

i think that it's happened, while standby unit eraze it's configuation.

but, it's happen only on the onboard inerface, and not happend on the additional interface card ports.

interface down of ASA standby unit after "wr standby" command

varrao — Wed, 17 Aug 2011 08:58:59 GMT

Hi,

Yes the interface would flap a bit when you do replication from the active to standby, it will erase all the config from the standby and then copy the config from the active unit to the standby unit, so there might be some flapping of interfaces, this is done, if you use the command write standby.

Hope this clears out.

-Varun

Please do rate helpful posts.

interface down of ASA standby unit after "wr standby" command

varrao — Wed, 17 Aug 2011 09:01:42 GMT

Here's the doc as well:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_active_standby.html#wp1079487

Thanks,

Varun

interface down of ASA standby unit after "wr standby" command

jjim7610 — Wed, 17 Aug 2011 09:07:29 GMT

thanks for reply.

but this is not happened on the version 7.2

and this interface flap not happend on the interface of additional interface card. ( ex. gi1/0, gi1/1)

only happend on onboard interface ( gi0/0, gi0/1)

can i accept it as kind of bug, or it can be the firmware problem ?

interface down of ASA standby unit after "wr standby" command

varrao — Wed, 17 Aug 2011 11:12:36 GMT

This should happen with the other versions as well, and should heppen with other interfaces as well, few suggestions, don't use write standby to copy the config to the standby device, this command should only be used if the config of the two firewalls is out of sync. You should use write meme, because only the config that is added woudl be copied to satndby device and woudl give you better results.

Moreover consider the option for portfast on switchports as recommended:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

If you still feel there is something that needs to be investigated, i would suggest you to kindly open a TAC case for it, for further analysis.

Thanks,

Varun