ASA 8.3 failover problem

[rashad_cisco]

Hi dears,
recently I have configured active/standby configuration on cisco ASA 8.3. It worked 2-3 day normaly without any problem. Next day I have noticed that active/standby configuration not functioning as expected. Active unit was not saw the standby unit, each of them worked as stand alone unit. It is happened periodically.  I changed cables between ports, connect ASAs through vlan , but it didnt help. I think there is some bugs in ASA 8.3 regarding active/standby config. The active/standby config is shown below:

Primary:

failover lan unit primary
failover lan interface FAILOVER g0/3
failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2
interface g0/3
no shut
failover link FAILOVER
failover

Secondary:

failover lan interface FAILOVER g0/3
failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2
interface g0/3
no shut
failover lan unit secondary
failover

Did anybody faced with such type problem? and how to resolve it ?

Thank you in advance,

BR,
Rashad

[PAUL GILBERT ARIAS]

I don't see the failover link configured. If you do have it then have you checked your logs or have you tried using debugs for failover?

Sent from Cisco Technical Support iPhone App

[rashad_cisco]

Hi Paul,

Thank you for your reply. In primary unit you can see the failover link configuration:

Primary:

failover lan unit primary

failover lan interface FAILOVER g0/3

failover interface ip FAILOVER 172.24.15.1 255.255.255.0 standby 172.24.15.2

interface g0/3

no shut

failover link FAILOVER -----> failover link configuration

BR,

Rashad

[PAUL GILBERT ARIAS]

And on your secondary unit?

Sent from Cisco Technical Support iPhone App

[rashad_cisco]

Paul,

I referenced to cisco document http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml.

In this document they dont mentioned about  "failover link" on the second unit. I think anywhere secondory unit will be copied this command from active unit.

Is it mondatary to issue  the "failover link" command on the secondary unit ?

BR,

Rashad

[PAUL GILBERT ARIAS]

failover link is used for stateful failover. I always add that line manually on both units. If you do a show run failover on the secondary unit and you don't see that line it means it didn't got copied from the primary unit or that the configurations are not synchronized.

[rashad_cisco]

Hi Paul,

Thank you for your advise, the "failover link" command on the second unit helped.

BR,

Rashad