topic Re: Failover/sync issue in Network Security

Failover/sync issue

marc07cisco — Fri, 21 Feb 2020 15:39:32 GMT

Hi Cisco Experts,

We have recently replaced our standby ASA5520, the failover was turned off on the primary box during the replacement being fitted(this is where we think our mistake has happened!!!).

Once we had the upgraded the standby asa to 9.1(7.4)(same as primary). we turned the failover on the primary.

We appear to have lost management access to the firewall, I think that the synchronised possibly from secondary to primary because both boxes think they are the active box. Is there another possibility? Has the cluster gone down because it need a box rebooting to decide which one is the active box?

We are sending an engineer to site currently, I was going to get them to console in(no remote console) and reboot the secondary in hope that the configuration in the primary is still there.

Re: Failover/sync issue

Marius Gunnerud — Fri, 20 Apr 2018 19:04:44 GMT

If you configured the replacement secondary ASA with "failover lan unit secondary" it should not have overwritten the primary. If this command was not added or it was configured to primary, you would have a split brain issue and it is possible that the active primary ASA configuration has been overwritten.

I have done quite a few of these replacements and have never had to do a reboot of the ASA to get the failover up.

Re: Failover/sync issue

marc07cisco — Fri, 20 Apr 2018 19:14:00 GMT

Thanks Marius,

Yes I believe the "failover lan unit secondary" was added, so unsure why we lost management access at the moment.

So if both PRIMARY & SECONDARY are active I take it when failover is turned on (#failover) then the boxes work it out between themselves using there lan unit status?

Re: Failover/sync issue

Marius Gunnerud — Fri, 20 Apr 2018 19:19:51 GMT

So if both PRIMARY & SECONDARY are active I take it when failover is turned on (#failover) then the boxes work it out between themselves using there lan unit status?

The ASA that is the current active primary will remain as the primary until a failover situation occurs or manually changed.

You could issue the "show failover", "show failover history" and "show failover status" for more information.

Another possibility is that this is an ARP issue on the next hop device.

Re: Failover/sync issue

Florin Barhala — Mon, 23 Apr 2018 08:36:11 GMT

Did you find out what actually happen?

Re: Failover/sync issue

marc07cisco — Mon, 23 Apr 2018 08:40:03 GMT

Hi Florin,

Not yet, we are hoping to get somone to site today to check. I will update the chat once we
Jave found out thanks