cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

532
Views
0
Helpful
3
Replies
Highlighted
Beginner

ASA Active/Standby Running comparison

Just want to check, is there a command that will compare configuration of Active and Standby unit or at least indicate out of sync configuration. For some reason I think there was or is...

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: ASA Active/Standby Running comparison

Hello,

If you feel that there is a config mismatch, please issue the command write standby on active device.

If you enter the write standby command on  the active unit, the standby unit clears its running configuration  (except for the failover commands used to communicate with the active  unit), and the active unit sends its entire configuration to the standby  unit.

Also, save the configs from both firewall in .doc file and use MS word compare utility.

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

View solution in original post

3 REPLIES 3
Highlighted
Cisco Employee

Re: ASA Active/Standby Running comparison

Hello,

If you feel that there is a config mismatch, please issue the command write standby on active device.

If you enter the write standby command on  the active unit, the standby unit clears its running configuration  (except for the failover commands used to communicate with the active  unit), and the active unit sends its entire configuration to the standby  unit.

Also, save the configs from both firewall in .doc file and use MS word compare utility.

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

View solution in original post

Highlighted
Beginner

Re: ASA Active/Standby Running comparison

I am aware of these commands my issue would be if someone has made changes to the standby and primary and did not save the configuration across using wr active or wr stanby.

Simply put,

Active

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 1.0.0.0 host 1.0.0.0 eq http

access-list inside_in extended permit host 5.0.0.0 host 5.0.0.0 eq http

Standby

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 7.0.0.0 host 7.0.0.0 eq http

access-list inside_in extended permit ip object-group A-SERVERS object-group MORE-SERVERS eq PORTS

This is minor expample but when multiplied by 10 or more makes it dificult to troubleshoot

PS

As for comparing offloaded configs to a file I have always relied on Notepad++ compare extension

Highlighted
Cisco Employee

Re: ASA Active/Standby Running comparison

If the commands are entered on primary firewall which is in standby, then that will neve be replicated to active device and not be part of running coniguration. I doubt if we have any such command to

  • copy from standby to active
  • compare 2 configs


Packet capture ASA/PIX - FWSM

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.