11-15-2013 10:48 AM - edited 02-21-2020 05:02 AM
So I've got a customer on an ASA5510 everything is working great (VPN site to site, AnyConnect Essentials).
They want to have another 5510 in standby mode so if the primary fails it takes over.
I look over the documents and at the HA/Failover setup in ASDM and it looks like a piece of cake.
On the standby I connect Port 0 to the Wan VLAN, Identical to the Active.
Port 1 to the LAN VLAN, then port 2 and port 3 directly to the port 2 and port 3 on the Active.
I have both ASDM pages open and first configure the standby failover with preference as the secondary.
Then go to the active ASDM and enter that info with preference as the primary.
As soon as I hit apply I loose connetivity with the primary I loose connectivity on the Active box through the managerment interface.
The worst scenario that could have happened. My active ASA has synced up with the backup ASA and now has the default ASA configs loaded.
I have someone power off the standby ASA that has now become active.
I then copy and paste the last running config that luckily I have saved through the console port and customer seems to be back up.
My question is what did I do wrong?
The only thing I can figure out is there is a box on the failover where you enter the number of interfaces that must fail before it takes control and that was set to 1. I had the Wan and LAN interfaces disabled when I applied so maybe it saw that and defaulted.
Should I copy the current running config on the active to the standy box before I try to enable Active / Standby and then just change the Wan and LAN interface IPs?
Thanks for your time.
11-15-2013 12:02 PM
Hello can you post "show run fail "
11-15-2013 12:04 PM
The problem is most likely that you were monitoring the interfaces that were disabled.
You could configure the Active ASA first. then once it is configured issue the show failover command and see if the interfaces are monitored. Then remove monitoring from the interfaces that are disabled:
no monitor-interface
Then when you add the standby ASA to the failover pair, it should remain in standby. When the WAN and LAN links become active, then you can add the monitor-interface command again.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide