topic Re: ASA 5525 No Active Mate Detected in Network Security

ASA 5525 No Active Mate Detected

netspazz — Fri, 21 Feb 2020 15:09:38 GMT

ok, this is strange. I have 2 5525's in failover mode and both are becoming active, since they cannot communicate with each other. I did a write erase on my standby to start over. I then configured the failover interface, we are using channel port, 0/4 and 0/5. I then configured the failover commands to use the port-channel and gave it the ip of active and standby. Here is the strange part, I can ping the IP's, both active and standby from both the 5525's, yet both firewalls cannot detect a mate! I have replaced the cables just to make sure, can still ping each other, but cannot bring up the mate.

any ideas? I figure if I can ping each other through the failover interfaces I should be good to go.

thanks

Re: ASA 5525 No Active Mate Detected

Rob Ingram — Wed, 17 Jan 2018 19:43:25 GMT

Hi, Was this previously working or a brand new installation? Can you post the configuration commands for interface and failover for both devices?

Re: ASA 5525 No Active Mate Detected

Richard Burts — Wed, 17 Jan 2018 19:51:35 GMT

If both ASA can ping both addresses then it looks like there is basic connectivity. If they are not finding the mate then it sounds like something is missing or is incorrect in the configuration. Posting config details would be a good next step. Also good if you can clarify whether this failover pair ever worked or if this is a fresh install.

HTH

Rick

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 19:53:46 GMT

<Primary unit>

failover
failover lan unit primary
failover lan interface FAILOVER Port-channel1
failover polltime unit msec 200 holdtime 1
failover polltime interface msec 500 holdtime 5
failover key 8 <removed>
failover link FAILOVER Port-channel1
failover interface ip FAILOVER 172.16.16.105 255.255.255.252 standby 172.16.16.106

interface GigabitEthernet0/4
channel-group 1 mode active
interface GigabitEthernet0/5
channel-group 1 mode active
interface Port-channel1
description LAN/STATE Failover Interface
lacp max-bundle 8

<Secondary unit>

failover
failover lan unit secondary
failover lan interface FAILOVER Port-channel1
failover polltime unit msec 200 holdtime 1
failover polltime interface msec 500 holdtime 5
failover key 8 <removed>
failover link FAILOVER Port-channel1
failover interface ip FAILOVER 172.16.16.105 255.255.255.252 standby 172.16.16.106

interface GigabitEthernet0/4
channel-group 1 mode active
interface GigabitEthernet0/5
channel-group 1 mode active
interface Port-channel1
description LAN/STATE Failover Interface
lacp max-bundle 8

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 19:59:17 GMT

These did work awhile back. I am bringing these up and first did an upgrade to Version 9.6(3)1, not sure what the older version was, maybe 9.2 something. Then loaded the configs. This could be something that the older config is having some issue with the newer release. I have brought up 3 pairs and all have the same issue, very strange.

Re: ASA 5525 No Active Mate Detected

Rob Ingram — Wed, 17 Jan 2018 20:02:22 GMT

Did you upgrade the firmware on both ASAs? For failover to work they need to be the same version

Could you provide the output from "show failover" please?

Re: ASA 5525 No Active Mate Detected

Richard Burts — Wed, 17 Jan 2018 20:03:30 GMT

Thanks for the config info. Would you post the output of show version?

HTH

Rick

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 20:46:48 GMT

This is the #sh failover from the primary, on the secondary I have a slimmed down config, just the failover links.

XXXXXX/pri/act# sh fail
Failover On
Failover unit Primary
Failover LAN Interface: FAILOVER Port-channel1 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 200 milliseconds, holdtime 1 seconds
Interface Poll frequency 500 milliseconds, holdtime 5 seconds
Interface Policy 1
Monitored Interfaces 2 of 216 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.6(3)1, Mate Unknown
Serial Number: Ours XXXXXXXX, Mate Unknown
Last Failover at: 17:37:34 UTC Jan 17 2018
        This host: Primary - Active
                Active time: 7662 (sec)
                slot 0: ASA5525 hw/sw rev (1.0/9.6(3)1) status (Up Sys)
                  Interface outside (172.16.34.1): Unknown (Waiting)
                  Interface management (172.16.18.103): Normal (Not-Monitored)
                  Interface inside (172.16.16.89): Unknown (Waiting)
        Other host: Secondary - Failed
                Active time: 0 (sec)
                  Interface outside (172.16.34.2): Unknown (Waiting)
                  Interface management (172.16.18.104): Unknown (Not-Monitored)
                  Interface inside (172.16.16.90): Unknown (Waiting)

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 20:43:59 GMT

Both units are running the same software

XXXXXX/pri/act# sh ver

Cisco Adaptive Security Appliance Software Version 9.6(3)1
Device Manager Version 7.7(1)151

Compiled on Thu 30-Mar-17 21:40 PDT by builders
System image file is "disk0:/asa963-1-smp-k8.bin"
Config file at boot was "startup-config"

XXXXXX up 3 hours 4 mins
failover cluster up 3 hours 4 mins

Hardware: ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)
ASA: 4284 MB RAM, 1 CPU (1 core)

Re: ASA 5525 No Active Mate Detected

Richard Burts — Wed, 17 Jan 2018 20:50:12 GMT

Could you make sure that logging to the console is enabled on one of the ASA, connect to the console of that ASA, reboot the ASA, and post the messages generated during boot and the attempt to find the mate?

HTH

Rick

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 21:12:25 GMT

I may have found an issue. While enabling logging I saw the following message while enabling failover on the unit.

(VPN-secondary) HA progression callback: id=3, seg=200, grp=0, event=200, op=17,my=Just Active, peer=Not Detected.

could this be a crypto issue between the units? the config file that was uploaded may have been a text file that may have been copied from a putty window, not a true downloaded config file. I believe when files are saved like this you loose all crypto keys. On the secondary I just did a new config and entered data for the interface and failover, no crypto information.

thanks

Re: ASA 5525 No Active Mate Detected

Rob Ingram — Wed, 17 Jan 2018 21:22:16 GMT

Perhaps try re-entering the key on both ASAs? Maybe try without a key first or use 0 instead of 8 "failover key 0 xxxxxxx" to see if that works

Re: ASA 5525 No Active Mate Detected

netspazz — Wed, 17 Jan 2018 21:37:44 GMT

that was it!!! I replaced the "8" with a "0" (no encryption). How do I rerun the encryption on both system so they will sync up? Also, is this an issue with recovering the config the wrong way, or is this always the case when downloading a config file?

Thanks

Re: ASA 5525 No Active Mate Detected

Rob Ingram — Wed, 17 Jan 2018 21:43:40 GMT

Cool. I think the key is just obscured in the running config and not copyable, that's why you had the issue. You may want to use "failover ipsec pre-shared-key"to encrypt the key between the ASAs.

Failover config guide here:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/configuration/general/asa-99-general-config/ha-failover.pdf

Re: ASA 5525 No Active Mate Detected

Richard Burts — Thu, 18 Jan 2018 16:03:01 GMT

Glad to know that you have resolved the issue and that it turned out to be the crypto key. Using the show running-config is not a good way to back up the config - as you have discovered. To back up the config you could use the copy command to transfer the config (including keys) using TFTP, or FTP. Or if you want a text file you could use the command more system:running-config which will give you the text file and it will include the keys.

HTH

Rick