topic Re: FWSM Lost Failover communications with mate in Network Security

FWSM Lost Failover communications with mate

Sung Min Cho — Mon, 11 Mar 2019 17:10:57 GMT

All,

I experinced critical problem for our customer service pertaing to communication fail for FT between FWSMs.

I can just find the log in FWSM as follows and can't find any physical log as interface down in C6500 at that moment.

Now our FWSM OS version is 3.2(7) and jsut monitor-interface option is applied at outside interface in FWSM.

Main FWSM

1|Feb 13 2010 01:49:19|105005: (Secondary) Lost Failover communications with mate on interface statelink
1|Feb 13 2010 01:49:20|105004: (Secondary) Monitoring on interface statelink normal

Backup FWSM

1|Feb 13 2010 01:49:17|105005: (Primary) Lost Failover communications with mate on interface statelink
1|Feb 13 2010 01:49:22|105004: (Primary) Monitoring on interface statelink normal
1|Feb 13 2010 01:51:24|105005: (Primary) Lost Failover communications with mate on interface outside
1|Feb 13 2010 01:51:24|105008: (Primary) Testing Interface outside
1|Feb 13 2010 01:51:24|105009: (Primary) Testing on interface outside Passed

Our problem is recovered automatically after 2m ~ 3m but that is reoccured after 1 day.

I already opend the TAC case (SR 613646199) but I didn't get any correct cause for problem and they just recommend to change the FWSM through RMA.

Any advice for our problem whould be greatly appreciated.

Thanks,

Sungmin Cho

Re: FWSM Lost Failover communications with mate

Jon Marshall — Wed, 17 Feb 2010 10:35:46 GMT

minmin5063 wrote:
All,
I experinced critical problem for our customer service pertaing to communication fail for FT between FWSMs.
I can just find the log in FWSM as follows and can't find any physical log as interface down in C6500 at that moment.
Now our FWSM OS version is 3.2(7) and jsut monitor-interface option is applied at outside interface in FWSM. 
Main FWSM
1|Feb 13 2010 01:49:19|105005: (Secondary) Lost Failover communications with mate on interface statelink
1|Feb 13 2010 01:49:20|105004: (Secondary) Monitoring on interface statelink normal
Backup FWSM

1|Feb 13 2010 01:49:17|105005: (Primary) Lost Failover communications with mate on interface statelink
1|Feb 13 2010 01:49:22|105004: (Primary) Monitoring on interface statelink normal
1|Feb 13 2010 01:51:24|105005: (Primary) Lost Failover communications with mate on interface outside
1|Feb 13 2010 01:51:24|105008: (Primary) Testing Interface outside
1|Feb 13 2010 01:51:24|105009: (Primary) Testing on interface outside Passed
Our problem is recovered automatically after 2m ~ 3m but that is reoccured after 1 day.
I already opend the TAC case (SR 613646199)  but I didn't get any correct cause for problem and they just recommend to change the FWSM through RMA.  
Any advice for our problem whould be greatly appreciated.
Thanks,
Sungmin Cho

Sungmin

Does the FWSM have a dedicated link between the 6500 switches or are you using the interconnect that all the other traffic uses as well ?

If you are using the same interconnect as other traffic it could be worth trying to setup a dedicated interconnect just for the FWSM.

Jon

Re: FWSM Lost Failover communications with mate

Sung Min Cho — Wed, 17 Feb 2010 10:54:59 GMT

Jon,

We already divided the links between C6500s for FT (Regular and Stateful Failover) and data.

Thanks,

Sungmin

Re: FWSM Lost Failover communications with mate

Kureli Sankar — Wed, 17 Feb 2010 15:28:33 GMT

We have seen similar issues due to defect CSCsl39710.

Make sure you are running a code on the switch side where this is resolved.

Also, make sure the blade is not seeing more traffic than it can handle at any given time. If so, icmp will be given lower priority and interface monitoring may fail as ping test is one of them.

-KS

Re: FWSM Lost Failover communications with mate

Sung Min Cho — Thu, 18 Feb 2010 07:38:26 GMT

KS,

First of all, thank you for your reply.

The followinfg is mac-address-table at that time the problem occured.

* 903 001a.6c3d.9200 dynamic Yes 0 Po273

* 1127 001a.6c3d.9200 dynamic Yes 0 Po273

* 1121 001a.6c3d.9200 dynamic Yes 0 Po273

* 1101 001a.6c3d.9200 dynamic Yes 0 Po273
* 1100 001a.6c3d.9200 dynamic Yes 0 Po273

* 174 001a.6c3d.9200   dynamic Yes          0   Po273
* 175 001a.6c3d.9200   dynamic Yes          0   Po273
* 180 001a.6c3d.9200   dynamic Yes          0   Po273
* 178 001a.6c3d.9200   dynamic Yes          5   Po273
* 177 001a.6c3d.9200   dynamic Yes         10   Po273
* 191 001a.6c3d.9200   dynamic Yes          0   Po273
* 189 001a.6c3d.9200   dynamic Yes          0   Po273
* 187 001a.6c3d.9200   dynamic Yes          0   Po273

.................................................................................

We think that C6500 properly learned the MAC address of the FWSM at that moment.

Thanks,

Sungmin

Re: FWSM Lost Failover communications with mate

Rafael Trujilho — Fri, 17 Dec 2010 18:32:18 GMT

All,

I'm with problems the FWSM in communication for management interface.

Basically the setup is correct, but I have had the record of the logs with a frequency below:

Main FWSM

1|Dec 17 2010 13:01:41|105009: (Secondary_group_2) Testing on interface MANAGEMENT Passed

1|Dec 17 2010 13:01:37|105008: (Secondary) Testing Interface MANAGEMENT

1|Dec 17 2010 13:01:36|105005: (Secondary_group_2) Lost Failover communications with mate on interface MANAGEMENT

FWSM Version 4.1(3)

Catalyst 6509 Version 12.2(33).SXI4a

Could anyone suggest something?

Thanks!

Re: FWSM Lost Failover communications with mate

Kureli Sankar — Sat, 18 Dec 2010 02:15:10 GMT

The only lasts for 5 seconds and then quickly recovers.

It may be a busy interface. You can try to capture all traffic (IP protocol 105) on this interface on both the units when the problem occurs and see why what one unit sends doesn't arrive on the other unit and the interface goes into testing mode.

-KS

Re: FWSM Lost Failover communications with mate

Rafael Trujilho — Mon, 20 Dec 2010 16:32:47 GMT

Hi KS,

Considering that the device is an FWSM, it could mean a hardware problem?

Thanks,

Trujilho

Re: FWSM Lost Failover communications with mate

phillchannon — Tue, 29 Mar 2011 23:09:06 GMT

We've just experienced what seems to be the exact same thing.

Did you get a resolution to this ? How did you go with the TAC case ?

Thanks!

Phill.

Re: FWSM Lost Failover communications with mate

Ian Beck — Tue, 12 Apr 2011 10:24:40 GMT

Hi,

How was this resolved ?

As we are now seeing the same issue.

Many thanks

Re: FWSM Lost Failover communications with mate

Ian Beck — Tue, 12 Apr 2011 11:13:42 GMT

Hi,

Found my issue :

Caused by a static NAT using the Firewall Interface as the NAT Addrees, changed it to a assigned IP Address and the problem went away !!!

Thanks