asa 5512-X failed failover and firepower?

[baselzind]

i have two 5512-x connected and configured with failover , we had firepower configured with one of them only "the secondary" , recently we found that failover under show failover is show primary - failed also under show failover history it shows "detect service card failure" , both are running 9.8 , is it because one of them only have firepower installed that the failover is failing? how do i know failure reason?

[niko]

You would be doing better by turning off the service module monitoring, so failover will not monitor the state of the FP module and will not failover.

#no monitor-interface service-module 

Having FP running on one device of the failover pair is not a standard situation, does not make sense generally and may be considered as a failure by ASA - "service card failure" makes me think that's exactly the reason.

More information: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/200944-Disable-Service-Module-Monitoring-on-ASA.html 

[baselzind]

the customer cannot afford another firepower license so i need to make due with one firepower , so this command and a restart for the primary failed asa should make the primary show standby normally?

[niko · Accepted solution]

You may do this without a restart.

I'm assuming the primary firewall is in failed state and secondary is an active one.

1) Disable service module monitoring, save config (do it on the active firewall as usual);

2) Check if the primary firewall is standby ready;

3) If everything looks good, do #no failover active on the secondary/active firewall.

4) Primary should be the active one now, secondary should be standby ready and failover should be in a proper state.

[baselzind]

thank you so much for the help , the command worked but i still needed to restart the primary to get the standby status though