topic Re: ASA 5540 - Failover in Network Security

ASA 5540 - Failover

ttran — Mon, 11 Mar 2019 16:58:05 GMT

Last night my firewall failover to secondary suddenly and I am still trying to find the root cause. Looking at the log and history, I saw the reason of failover because the "Service card in other unit has failed". Further investigating and the card is SSM according to Cisco web page. So I think it is the AIP-SSM card. Still do not know why the card was failed that trigger the failover. ASA running code 8.0.4. Right now the secondary is still the active ASA. We have the Netscaler in the DMZ doing web hosting. Could it be to much traffic for the ASA and/or AIP-SSM to handle? Anyone has any idea is appreciated.

Re: ASA 5540 - Failover

Panos Kampanakis — Fri, 15 Jan 2010 22:47:12 GMT

There could be multiple reasons a card could fail.

Software defect, hardware issue in the backplane, just a glitch, overload of the card, these are some.

You need to investigate if the card keeps failing or if it was an one off event.

to reset the card do "hw module 1 reset" on the ASA.

I hope it helps.

Re: ASA 5540 - Failover

Kent Heide — Sat, 16 Jan 2010 10:14:44 GMT

What output does you get from the module when you do the `show module` command?

Re: ASA 5540 - Failover

vilaxmi — Mon, 18 Jan 2010 01:24:50 GMT

Hello,

You might want to swap the AIP SSM module in the ASA with a spare KNOWN GOOD module and monitor the performance of card.

Thanks

Vijaya

Re: ASA 5540 - Failover

vilaxmi — Mon, 18 Jan 2010 01:29:01 GMT

Hello,

You might want to try swapping the AIP SSM module on your ASA with a KNOWN GOOD CARD, and then monitor the performance, as this could be a hardware fault.

Thanks,

Vijaya

Re: ASA 5540 - Failover

ttran — Mon, 18 Jan 2010 17:26:52 GMT

Thank you everyone answer this question. The AIP-SSM20 card is still functioning after the failover.

I was able to ssh to the card and show version to make sure the apps and engine is running.

Show module indicated the card is up state. This is still in mystery.

This was the first time it happened so not sure what cause it.

Re: ASA 5540 - Failover

ttran — Tue, 19 Jan 2010 14:16:19 GMT

I checked the ASA 5540 specs and the firewall throughput is 650Mbps and the firewall and IPS thoughput is 500Mbps with AIP-SSM20.

So I am not clear which thoughput is applied to firewall:

1. Without AIP-SSM card firewall thoughput is 650M?

2. With AIP-SSM card firewall thoughput is 500M?

If item 2 is true then my firewall thoughput is 500M instead of 650M?

The configuration for the SSM to ASA is inline mode. Trace back to the history and approximately 10 to 15 minutes before the failover

took place, the Unix admin experience slowness on his servers to internet users accessing the webpage/webcontain. When the failover

happened approximately 2 minutes after everything is back to normal. Web traffice before the failover is around 350Mbps.

Re: ASA 5540 - Failover

Dileep Sivadas Padmini — Wed, 20 Jan 2010 05:40:55 GMT

Throughput depends upon how traffic redirected to AIP module(using class map ), if all then there will be a bottleneck.

What about the IPS alerts, it will definitely give some answer that caused the issue.

Dileep

Re: ASA 5540 - Failover

ttran — Wed, 20 Jan 2010 15:40:36 GMT

Thanks Dileep. My thought is the same since SSM in line will cause some problem with thoughput.

I tried to check the logs on the IPS but did not see anything out of ordinary (I think) since I am not able to show

any actual events back on January 14 just in general of tcp traffic and there is no idication of the attack. For sure

I was able to see the ASA CPU hits around 75% as normal between 40% to 45% when traffic around 350M. When

failover happened, there were few spike around 530M and the Secondary is working fine.

I am planning to remove the inspect http from the global policy inspection. Any idea how the ASA behave when

the inspection http is removed. Is it a good idea?

PK,

Thank you for answer from the other question and I know you did mention will causing some problem if inspection http is removed, is it going to be a big problem because http will not be inspect by the IPS.