ASA Active/Standby Running comparison

[uber_cookie]

Just want to check, is there a command that will compare configuration of Active and Standby unit or at least indicate out of sync configuration. For some reason I think there was or is...

[csaxena · Accepted solution]

Hello,

If you feel that there is a config mismatch, please issue the command write standby on active device.

If you enter the write standby command on  the active unit, the standby unit clears its running configuration  (except for the failover commands used to communicate with the active  unit), and the active unit sends its entire configuration to the standby  unit.

Also, save the configs from both firewall in .doc file and use MS word compare utility.

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.

[uber_cookie]

I am aware of these commands my issue would be if someone has made changes to the standby and primary and did not save the configuration across using wr active or wr stanby.

Simply put,

Active

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 1.0.0.0 host 1.0.0.0 eq http

access-list inside_in extended permit host 5.0.0.0 host 5.0.0.0 eq http

Standby

access-list inside_in extended permit tcp host 10.0.0.0 host 10.0.0.0 eq http

access-list inside_in extended permit tcp host 7.0.0.0 host 7.0.0.0 eq http

access-list inside_in extended permit ip object-group A-SERVERS object-group MORE-SERVERS eq PORTS

This is minor expample but when multiplied by 10 or more makes it dificult to troubleshoot

PS

As for comparing offloaded configs to a file I have always relied on Notepad++ compare extension

[csaxena]

If the commands are entered on primary firewall which is in standby, then that will neve be replicated to active device and not be part of running coniguration. I doubt if we have any such command to

• copy from standby to active
• compare 2 configs

Packet capture ASA/PIX - FWSM

Hope this helps. Please reply if you need further assistance.

Regards,

Chirag

P.S.: Please mark this thread as answered if you feel your query is answered. Do.rate helpful posts.