topic Re: cannot ping/telnet the standby asa in Network Security

cannot ping/telnet the standby asa

kokhong.chew — Mon, 11 Mar 2019 16:46:48 GMT

I got 2 x 5520 ASAs configured in active/standby mode and they are connected to 2 x 4500 switches in which too configured for failover.

Telnet to ASAs is allowed only via subnet 172.18.0.0./24

I can only ping and telnet to the active ASA from subnet 172.18.0.0./24 but not the standby

But i can ping and telnet to both the active and standby ASAs within the 4500 switches.

Please advise ? Thanks

Re: cannot ping/telnet the standby asa

Jon Marshall — Wed, 09 Dec 2009 12:21:38 GMT

Can you check the routing table on the standby firewall and compare it to the routing table on the active firewall.

Are you exchanging routes dynamically between the ASA and the 4500 switches ?

Jon

Re: cannot ping/telnet the standby asa

kokhong.chew — Thu, 10 Dec 2009 01:38:50 GMT

Hi Jon

No dynamic routing in standby ASA

C 172.18.5.0 255.255.255.0 is directly connected, TJM_LAN

There are dynamic routings in active ASA

D    172.18.186.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.212.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.213.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.210.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.211.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.208.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.209.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.206.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.207.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.204.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.205.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.202.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.203.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.201.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
C    172.18.7.8 255.255.255.248 is directly connected, LEASED_LINE
D    172.18.4.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                              [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
C    172.18.5.0 255.255.255.0 is directly connected, TJM_LAN
D    172.18.2.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                              [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.3.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                              [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    MES-TJM-LAN18 255.255.0.0 is a summary, 115:52:25, Null0
D    172.18.112.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.113.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.110.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.111.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.108.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.109.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.106.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.107.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.104.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.105.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.102.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.103.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN
D    172.18.101.0 255.255.255.0 [90/3072] via 172.18.5.3, 115:52:18, TJM_LAN
                                [90/3072] via 172.18.5.2, 115:52:18, TJM_LAN

Re: cannot ping/telnet the standby asa

rickyt888 — Thu, 10 Dec 2009 18:37:14 GMT

Make sure there is static route pointing the inside. Since it is running eigrp, it is the correct output that the primary showing entire routing table and the failover is only showing Connected or Static.

route inside 172.18.0.0 255.255.0.0 1

Hope this help.

Re: cannot ping/telnet the standby asa

Kureli Sankar — Thu, 10 Dec 2009 19:41:43 GMT

Pls. try this ping test from a directly connected host to the inside interface. As you are using dyanmic routing prototcol, these updates will not be sent to the standby until it becomes active.

Pls. read here:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1052476

Pls. read the column: State Information Not Passed to Standby Unit

-KS

Re: cannot ping/telnet the standby asa

kokhong.chew — Fri, 11 Dec 2009 01:23:07 GMT

Hi Rickyt888

Thanks. I will try . . . add the static route on the standby ASA only ? By the way,it is by designsuch that only can ping/telnet active ASA ?

Re: cannot ping/telnet the standby asa

Kureli Sankar — Fri, 11 Dec 2009 05:06:58 GMT

No. You will be able to telnet/ssh/asdm to the active as well as the standby provided you have a route from the client to both the active and the standby firewall.

Use a host/client that belongs on the same subnet (so dynamic routing doesn't come into the picture) as the active and the standby and you will be able to telnet/ssh/asdm to both of them.

-KS

Re: cannot ping/telnet the standby asa

sureshkrishnan — Thu, 17 Dec 2009 23:45:31 GMT

You will have to add a static route with administrative distance higher number than your routing protocol. The static route applies to both Active and Standby firewalls. But, it will be used only on the Standby because of the administrative distance.

Re: cannot ping/telnet the standby asa

sachinraja — Fri, 18 Dec 2009 17:47:27 GMT

Im not sure if ospf route synchronization would happen with standby ASA. as seen standby ASA just monitors the failover interfaces, and take the IP of the primary ASA if it fails.. having said this, you would be able to reach the standby ASA from the layer 3 subnet directly connected to the core switch. Have a static route on the core switch to reach the failover IP address (which is used just for mgmt purpose and not for routing), and redistribute that route to inside/outside , wherever needed ! Route tables info are not passed onto the secondary unit with stateful failover...

have a look at this topic in this forum:

https://supportforums.cisco.com/message/894013#894013

Hope this helps.. all the best..

Raj

Re: cannot ping/telnet the standby asa

kokhong.chew — Sat, 19 Dec 2009 00:58:41 GMT

So is it a design issue in active/standby failover mode ? ? ?

Re: cannot ping/telnet the standby asa

Kureli Sankar — Sat, 19 Dec 2009 01:07:27 GMT

You may not have read the link that I posted earlier.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/failover.html#wp1052476

State Information Not Passed to Standby Unit : The routing tables. After a failover occurs, some packets may be lost or routed out of the wrong interface (the default route) while the dynamic routing protocols rediscover routes.

The standby unit will only see connected and static route. It will not see any dynamic routes.

Your options are to add a static route (host route) to the monitoring server or authentication server or to use a host directly connected to the interface that you want to manage.

-KS

Re: cannot ping/telnet the standby asa

kokhong.chew — Sat, 19 Dec 2009 01:19:59 GMT

I did went through the link . . . but i cant find any mention of the suggested adding a static route unless i really miss it ?

Re: cannot ping/telnet the standby asa

sachinraja — Sat, 19 Dec 2009 01:41:26 GMT

I really dont think this is a design issue... i think thats the way the firewall works.. Since it works active/passive, and since it works only on primary ip address (which is active),the routing updates should originate from the active IP address. Passive IP / Failover IP is only used for keepalives etc !

and the failver IP address is only used for management... so, reachability to failover IP should be only through static ! which should be added on your L3 switch !

Hope this helps.. All the best

Raj

Re: cannot ping/telnet the standby asa

Kureli Sankar — Sat, 19 Dec 2009 01:46:05 GMT

That link does not talk about what you need to do accomplish in order to manage the standby unit. It just talks about what is to be expected with dynamic routing protocols in a failover scenario.

-KS

Re: cannot ping/telnet the standby asa

kokhong.chew — Sat, 19 Dec 2009 02:07:34 GMT

Raj

Shouldn't a static route be added in the standby instead of the L3 switch since the active is reachable

Re: cannot ping/telnet the standby asa

kokhong.chew — Sat, 19 Dec 2009 02:09:50 GMT

Well, now i can see that there isn't any documentation on how to manage the standby 😐

Re: cannot ping/telnet the standby asa

Kureli Sankar — Sat, 19 Dec 2009 02:15:03 GMT

Well, I guess it is obvoius that you need route and permission for "TO" the box traffic and Route, Translation and Permission for "THROUGH" the box traffic

Adding the route in the stanyby unit will not replicate to the acive. Config will be diff. on both units. You should only add command to the active unit. Since dynamic routing is preferred that is the reason Raj had given you a good suggestion to add a higher metric static route no the active unit.

-KS

Re: cannot ping/telnet the standby asa

kokhong.chew — Sat, 19 Dec 2009 02:21:03 GMT

anyway thanks.

i already confused . . . Raj's to add to L3 switch ! not ASA ?

Re: cannot ping/telnet the standby asa

sachinraja — Sat, 19 Dec 2009 02:43:43 GMT

Hi Hong

Yep.. it should be added on the firewall.. I was referring to the forward routes which should be added on L3, and not the reverse routing from the FW...

you should not add the route on standby fw, since the configs will not be synchronised with the primary... add a static route on your active firewall only to the management subnet pointing to the next hop L3 interface. then do a wr mem to synchronize the configs with the secondary... check connectivity after that.. in our setup here, we have close to 20 static routes in primary, (including the management subnet) which is replicated to failover firewall.. both the primay and secondry firewalls are reachable on telnet, ssh & ping ...

Try this and let us know..

Raj

Re: cannot ping/telnet the standby asa

sachinraja — Sat, 19 Dec 2009 02:46:08 GMT

route inside 172.18.0.0 255.255.255.0 172.18.5.3 on the primary and then synchronize the configs to failover unit

Raj