topic Re: ASA 8.3 failover problem in Network Security

ASA 8.3 failover problem

rashad_cisco — Mon, 11 Mar 2019 20:04:06 GMT

Hi dears,
recently I have configured active/standby configuration on cisco ASA 8.3. It worked 2-3 day normaly without any problem. Next day I have noticed that active/standby configuration not functioning as expected. Active unit was not saw the standby unit, each of them worked as stand alone unit. It is happened periodically. I changed cables between ports, connect ASAs through vlan , but it didnt help. I think there is some bugs in ASA 8.3 regarding active/standby config. The active/standby config is shown below:

Primary:

failover lan unit primary
failover lan interface FAILOVER g0/3
failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2
interface g0/3
no shut
failover link FAILOVER
failover

Secondary:

failover lan interface FAILOVER g0/3
failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2
interface g0/3
no shut
failover lan unit secondary
failover

Did anybody faced with such type problem? and how to resolve it ?

Thank you in advance,

BR,
Rashad

Re: ASA 8.3 failover problem

PAUL GILBERT ARIAS — Thu, 10 Mar 2011 12:36:35 GMT

I don't see the failover link configured. If you do have it then have you checked your logs or have you tried using debugs for failover?

Sent from Cisco Technical Support iPhone App

Re: ASA 8.3 failover problem

rashad_cisco — Thu, 10 Mar 2011 12:49:13 GMT

Hi Paul,

Thank you for your reply. In primary unit you can see the failover link configuration:

Primary:

failover lan unit primary

failover lan interface FAILOVER g0/3

failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2

interface g0/3

no shut

failover link FAILOVER -----> failover link configuration

BR,

Rashad

Re: ASA 8.3 failover problem

PAUL GILBERT ARIAS — Thu, 10 Mar 2011 13:19:43 GMT

And on your secondary unit?

Sent from Cisco Technical Support iPhone App

Re: ASA 8.3 failover problem

rashad_cisco — Thu, 10 Mar 2011 13:41:50 GMT

Paul,

I referenced to cisco document http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml.

In this document they dont mentioned about "failover link" on the second unit. I think anywhere secondory unit will be copied this command from active unit.

Is it mondatary to issue the "failover link" command on the secondary unit ?

BR,

Rashad

Re: ASA 8.3 failover problem

PAUL GILBERT ARIAS — Thu, 10 Mar 2011 14:06:48 GMT

failover link is used for stateful failover. I always add that line manually on both units. If you do a show run failover on the secondary unit and you don't see that line it means it didn't got copied from the primary unit or that the configurations are not synchronized.

Re: ASA 8.3 failover problem

rashad_cisco — Fri, 18 Mar 2011 06:07:16 GMT

Hi Paul,

Thank you for your advise, the "failover link" command on the second unit helped.

BR,

Rashad