topic ASA Active/Standby Running comparison in Network Security

ASA Active/Standby Running comparison

uber_cookie — Mon, 11 Mar 2019 19:54:59 GMT

Just want to check, is there a command that will compare configuration of Active and Standby unit or at least indicate out of sync configuration. For some reason I think there was or is...

Re: ASA Active/Standby Running comparison

csaxena — Wed, 23 Feb 2011 08:26:21 GMT

Hello,

If you feel that there is a config mismatch, please issue the command write standby on active device.

If you enter the write standby command on the active unit, the standby unit clears its running configuration (except for the failover commands used to communicate with the active unit), and the active unit sends its entire configuration to the standby unit.

Also, save the configs from both firewall in .doc file and use MS word compare utility.

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

Re: ASA Active/Standby Running comparison

uber_cookie — Wed, 23 Feb 2011 08:40:03 GMT

I am aware of these commands my issue would be if someone has made changes to the standby and primary and did not save the configuration across using wr active or wr stanby.

Simply put,

Active

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 1.0.0.0 host 1.0.0.0 eq http

access-list inside_in extended permit host 5.0.0.0 host 5.0.0.0 eq http

Standby

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 7.0.0.0 host 7.0.0.0 eq http

access-list inside_in extended permit ip object-group A-SERVERS object-group MORE-SERVERS eq PORTS

This is minor expample but when multiplied by 10 or more makes it dificult to troubleshoot

As for comparing offloaded configs to a file I have always relied on Notepad++ compare extension

Re: ASA Active/Standby Running comparison

csaxena — Wed, 23 Feb 2011 08:41:42 GMT

If the commands are entered on primary firewall which is in standby, then that will neve be replicated to active device and not be part of running coniguration. I doubt if we have any such command to

copy from standby to active
compare 2 configs

Packet capture ASA/PIX - FWSM

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.