topic Re: Standby ASA access in Network Security

Standby ASA access

rajeshk200_2 — Mon, 11 Mar 2019 15:06:06 GMT

HI there,

I have pair of ASA's configured as Active/Standby, I can access active ASA thro' ssh and ASDM, but not standby ASA, What we have to do to get hold of standby ASA access?

Many thanks,

Raj

Re: Standby ASA access

vikram_anumukonda — Tue, 17 Mar 2009 12:25:08 GMT

did you try connecting using the standby ip address assigned to ASA ?

Re: Standby ASA access

SOL10 — Tue, 17 Mar 2009 12:26:16 GMT

hi,

if they are working in active and standy mode then the config should copy across from the primary to the seconday.

please post your config from the primary ASA.

Re: Standby ASA access

rajeshk200_2 — Thu, 19 Mar 2009 13:09:42 GMT

Hi,

Tried with standby ASA IP , I can ping the IP , I am getting the message

"ssh_exchange_identification: Connection closed by remote host" whilst we do ssh,

I found the difference while we do telnet with port 22 on primary and secondary ASA, Primary session won't disconnect immediately where as secondaty ASA terminate the session immmediatelly as shown below.

Primary ASA response,

# telnet xxxxxx 22

Trying xxxxx...

Connected to xxxxxxxxxx.

Escape character is '^]'.

SSH-1.99-Cisco-1.25

Secondary ASA response

# telnet yyyyyyyyy 22

Trying yyyyyyyyyyy...

Connected to yyyyyyyyyy

Escape character is '^]'.

Connection closed by foreign host.

Any guess on reason why as configs on primary and secondary ASA are same?

Many thanks,

Rajesh

Re: Standby ASA access

Pravin Phadte — Thu, 19 Mar 2009 13:15:22 GMT

Simple solution...

Configure ssh for oustide or wan ip address on active...

SSH to active ... Then try standby should work

Hope this helps

Re: Standby ASA access

vikram_anumukonda — Thu, 19 Mar 2009 13:30:27 GMT

why don't you do ssh instead of telnet/22 and see what's showing in the logs.

Re: Standby ASA access

rajeshk200_2 — Thu, 19 Mar 2009 14:31:42 GMT

I can ssh primary ASA successfully and it's fine,While attempting ssh to secondary ASA I am getting error message below, I don't see any relevant logs on active.

"ssh_exchange_identification: Connection closed by remote host"

Thanks,

Raj

Re: Standby ASA access

vikram_anumukonda — Thu, 19 Mar 2009 15:57:42 GMT

Rajesh, try telnetting to the any of the interfaces of active & standby devices , if telnet works to both active & standby ip-address then it's an issue with the rsa keys.

Re: Standby ASA access

rajeshk200_2 — Fri, 20 Mar 2009 12:58:02 GMT

Telnet works fine for both active and standby ASA's, Is it possible to clear RSA keys for just secondary ASA ?,as I have no issues with primary one, If yes how do we do that?

Thanks,

Rajesh

Re: Standby ASA access

rajeshk200_2 — Fri, 20 Mar 2009 13:17:41 GMT

Yes, you are correct, it works after adding crypto keys on secondary ASA.

Many thanks,

Rajesh