Cisco ASA Failed to update IPSec failover runtime data on the standby unit

[secureIT]

Hi All,

Im getting the below logs, could someone assist..!!

Software Version 8.4(7) / ASA5580-20

%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit

[Aditya Ganjoo]

Hi,

ASA is hitting the following bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuj60572/?reffering_site=dumpcr

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[secureIT]

Hi Aditya,

Sorry that Bug ID is pointing towards a different problem -

Unable to assign ip address from the local pool due to 'Duplicate local'

Could you suggest which is opened in 8.4(7) and related to failed to update IPsec ?

[Aditya Ganjoo]

Hi,

There are duplicate bugs opened for this :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCue92144/?reffering_site=dumpcr

But the fix for the bugs are under this:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuj60572/?reffering_site=dumpcr

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[secureIT]

Hi Aditya,

These Bugs doesn't say about the issue "Failed to update IPSec failover runtime data on the standby unit", rather says about "Unable to assign Local Pool" only.

Somehow im unable to get convinced with the provided bugs. Could you please brief on the below logs and the Bug which you have given and correlate please...

My issue is getting below logs:-

%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.
%ASA-5-720012: (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit.

[Aditya Ganjoo]

Hi,

Not sure but did you check this bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCue92144/?reffering_site=dumpcr

This in turn is a duplicate of CSCuj60572.

I am not sure what is not clear.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[secureIT]

Hi Aditya,

The main concern is im not getting any documentation which says that the Bug ID CSCue92144 contains the issue - Symptom: Remote IPSec sessions are not syncing between ASAs when running in Active/Standby Pair.

When i open the same, it is giving another problem symptom.  When you search in google, i get the preview only which talks about session not syncing, but when i open the url another problem description is coming. Basically i need a documentation on bug id, problem symptom, recommendation etc. :)

[Renash Chandran · Accepted solution]

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuj60572

If you look under related bugs, you'll see the bug ID CSCue92144. Cisco updated that bug details page to redirect to CSCuj60572.

If you really want the documentation for CSCue92144, check the following link:

https://webcache.googleusercontent.com/search?q=cache:XREqZw8nHZAJ:https://quickview.cloudapps.cisco.com/quickview/bug/CSCue92144+&cd=1&hl=en&ct=clnk

If you logout of Cisco and then access the below link you'll get the page, but you won't see which versions are fixed.

https://quickview.cloudapps.cisco.com/quickview/bug/CSCue92144

[secureIT]

Hi All,

To mitigate this issue, I'm planning to upgrade my FW from 8.4(7) to 9.1(5).

Have seen multiple posts saying issues post upgrade. Is it safe to upgrade w/o any issues ? Pls assist.

Appliance Software Version 8.4(7)
Hardware:   ASA5580-20, 8192 MB RAM, CPU AMD Opteron 2600 MHz
            2 CPUs, 4 cores
Internal ATA Compact Flash, 1024MB
BIOS Flash XXXXXX @ 0xffc00000, 4096KB
This platform has an ASA5580-20 VPN Premium license.

[secureIT]

Hi Aditya,

Could you pls check and suggest..