topic Re: stateful Failover not functioning correctly in Network Security

stateful Failover not functioning correctly

KeithN123 — Mon, 11 Mar 2019 14:37:43 GMT

I have a pair of ASA5520's configure for failover. The OS, interfaces, and configuration on both devices are identical apart from the IP addresses. There are 8 interfaces in each device, failover monitoring every interface and the criteria is that 1 interface failure would trigger the failover. when I test the failover this is what happens:-

1) If I fail the switch that the ASA connects to, failover does not occur.

2) If I power off the primary ASA the the secondary unit becomes active.

3) If both firewalls are on and I force the secondary unit to failover active, both primary and secondary stay active.

am I missing something obvious? - would anyone be able to help me to resolve this issue please.

many thanks

Keith

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 16:06:50 GMT

Keith-

How are your ASA's connected for fail over (ie LAN based/cable based)? If they are LAN based, are you using a cross-over cable between the two or do they go through a switch?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 16:11:07 GMT

they are LAN based, connected through a switch - all the interfaces are connected to various vlans configured on switches - I can ping the ip address on the failover interface

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 16:15:06 GMT

A single switch or are they redundant as well?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 16:17:51 GMT

yes they are redundant as well - a pair of 4500's 10G link between them.

sh failover on primary and standby firewalls looks good

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 16:22:29 GMT

A single switch or are they redundant as well?

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 16:24:26 GMT

When you fail a switch, you can fail either one of the 4500's and the ASA's do not fail over properly correct?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 16:36:00 GMT

yes that's correct - the only way that failover seems to work is if I power off the primary unit. The secondary then becaomes active.

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 16:47:12 GMT

Could you post the following?

show failover

show failover interface

show interface [of the failover interfaces]

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 17:24:36 GMT

posted show failover

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 18:05:35 GMT

Everything looks good there. The 192.168.54.0 /30 network is not in the routing table of the 4500's right?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 18:19:30 GMT

no, they are configured on a separate vlan just for the failover interfaces.

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 18:28:08 GMT

I figured that, but just thought I would ask. When you fail one of the switches, can you ping between the ASA's on the failover interface?

ping 192.168.52.1 to 192.168.52.2 and visa-versa?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 18:29:21 GMT

yes

Re: stateful Failover not functioning correctly

Collin Clark — Thu, 15 Jan 2009 18:31:19 GMT

You shouldn't be able to. Is this in a lab? If so how about running an ICMP debug?

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 18:34:45 GMT

apologies Collin - I didn't read your reply properly - it's the 192.168.54 failover addresses that I can ping - I cannot ping any of the monitored interface addresses - thes are in a live environment, so I am limited with regard to testing until out of customer working hours.

Re: stateful Failover not functioning correctly

KeithN123 — Thu, 15 Jan 2009 23:49:05 GMT

Collin -

when the ASA's are both up, I can ping 192.168.54.1 from 192.168.54.2 and visa versa....when they are failed over I can't ping.