ASA active/passive - file management

[darren.g]

Learned ones! :-)

I've finally managed to get a window to implement active/passive across my pair of ASA5520's, and all works well except for one minor issue on the passive.

On config copy/parse in the initial setup, it complained about some of the requesit software not being available.

I had a rummage on the active node, and the only difference between the two is some anyconnect images which are on the active, but not the passive.

This isn't a huge issue, because I don't actually *use* any connect, however in trying to make the paassive happy, I ran into a problem.

I couldn't actually manipulate the passive node flash disk without using the console port and an X-modem upload (and if anyone thinks I'm going to upload 4 x 2 meg images via X-Modem at 9600 you're crazier than I am!).

So, my question is - is there any way, other than the only one I can see (failover tot he passive node, copy the files via TFTP over IP, fail back to the regular node) for my to either put the files onto the passive node flash, or copy them from the main node across the synchronisation link?

Thanks.

[Richard Burts · Accepted solution]

Darren

I am not clear what you have done (or not done) that causes this. But it is not the case in the failover ASAs that I have done. I just checked the failover unit of a pair of ASAs that I set up for a customer and I have no problem with accessing the ASA from multiple hops away and its route table includes the static routes that I configured on the primary along with the connected routes.

HTH

Rick

[darren.g]

Richard Burts wrote:
Darren
I am not clear what you have done (or not done) that causes this. But it is not the case in the failover ASAs that I have done. I just checked the failover unit of a pair of ASAs that I set up for a customer and I have no problem with accessing the ASA from multiple hops away and its route table includes the static routes that I configured on the primary along with the connected routes.
HTH
Rick

Ahhh.

The magic words. Static routes.

My firewall doesn't run any static routes (except for the default outbound). It's all OSPF.

I suspect this may be the issue - in which case I'm back where I started, needing to failover to manage the secondary's filesystem.

At least I'm now doing it the "supported' way, and should get a faster, more seamless failover.

Thanks for all your help.

Cheers.