I am new to this forum. If this needs to be moved that is fine.
Our organization is working on implementing Office 365. I am in charge of the networking end of it. We are running a pair if ASA5525-X in active / standby mode. I found a script that pulled the list of ip addresses from Microsoft and put them into ASA format. I then add a line at the top of the file to create an object in the ASA. I pull the file off our tftp server to running config via EEM script to create the 0ffice 365 object on the ASA. The tftp to running config happens after deleting all the current config lines via the EEM script. Everything seems to work. However, I get an warning on the standby ASA.
There are many Cisco formatted lines in it, and they all seem to get put into the object-group just fine.
I did contact Cisco, and my engineer had the comment below, and pointed me to this forum:
I replicated the issue and I was able to see that in our lab the same thing happens in the standby device, at this point I was researching on this and I did not find so much information about this problem, so I am going to advised you to use the Cisco forums as this feature is actually not supported by Cisco TAC, in this case this are the links to go to the forums:
Cisco TAC does not support nor create these types of scripts for customers. For any questions or suggestions you can reach out to the support community.
Could this be happening because the EEM script is running on both units at the same time and when the command on the active runs it tries to sync to the standby and that is why I am getting the warning?
Is there a way to not have the standby unit run the script, and just rely on the primary unit to do it?
I have not tried that script, but i do work with many EEM Script.
Just Technical / Implementation Point of view. Active / Standby - We always do change in Active, so Active Automatically sync the config to Stanby Unit.
In your case just do the config on Active and let Active Sync the config to Standby ? To verify this After Few Minutes download both the cofig if you like to and compare is that working as expected and config sync.
Personally i do not believe you need to make any changes in Secondary ( Standby Unitl here in your case).
This is an ASA bug and has been there for many years. When you enter an existing object into an object-group on the active firewall, nothing is printed on the console of the active unit, but the console of the standby unit complains this way: