ASA Failover Active/stanby

[Seifeddine-Tlili]

Greeting Everyone

I`m actually experiencing a very weird isssue with my ASA 5520

I have added a new one and configured failover but i got this when i`m enabling the failover

Mate's license (10GE I/O Disabled) is not compatible with my license (10GE I/O Enabled). Failover will be disabled.

I have checked the requirement again:

Same platforme

Same Amount of memroy

same ios/ASDM

the show version is the same in both ASA

ASA 1
Licensed features for this platform:
Maximum Physical Interfaces    : Unlimited
Maximum VLANs                  : 150      
Inside Hosts                   : Unlimited
Failover                       : Active/Active
VPN-DES                        : Enabled  
VPN-3DES-AES                   : Enabled  
Security Contexts              : 2        
GTP/GPRS                       : Disabled 
SSL VPN Peers                  : 2        
Total VPN Peers                : 750      
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled 
AnyConnect for Cisco VPN Phone : Disabled 
AnyConnect Essentials          : Disabled 
Advanced Endpoint Assessment   : Disabled 
UC Phone Proxy Sessions        : 2        
Total UC Proxy Sessions        : 2        
Botnet Traffic Filter          : Disabled

This platform has an ASA 5520 VPN Plus license.

The flash activation key is the SAME as the running key.

ASA2

Licensed features for this platform:
Maximum Physical Interfaces    : Unlimited
Maximum VLANs                  : 150      
Inside Hosts                   : Unlimited
Failover                       : Active/Active
VPN-DES                        : Enabled  
VPN-3DES-AES                   : Enabled  
Security Contexts              : 2        
GTP/GPRS                       : Disabled 
SSL VPN Peers                  : 2        
Total VPN Peers                : 750      
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled 
AnyConnect for Cisco VPN Phone : Disabled 
AnyConnect Essentials          : Disabled 
Advanced Endpoint Assessment   : Disabled 
UC Phone Proxy Sessions        : 2        
Total UC Proxy Sessions        : 2        
Botnet Traffic Filter          : Disabled

This platform has an ASA 5520 VPN Plus license.

Any thoughs and What the heck is a 10Ge in the 5520 !!!!!!

[Maykol Rojas]

Hello,

Would you please paste the whole show version? Do you have any SSM 4 gig extra module in any of the devices?

Cheers.

Mike

[Jennifer Halim]

There is an internal bug, and it's fixed in ASA 8.2.3, what is your current software version?

[Kureli Sankar]

I believe this is what Jennifer is talking about:   

CSCti70859    10GE Feature Enabled On Non-10GE Capable ASA Models

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti70859

I see that this is resolved only in 8.2.3(4)

-KS

[Seifeddine-Tlili]

Thanks Jennifer actually the bug is in version 8.2.3 so i had to downgrade to 8.2.2

Symptom:

Adaptive Security Appliance (ASA) fails to establish failover  communication with its peer after an upgrade to 8.2(3) software. The  following message is displayed:
%ASA-1-105045: (Primary) Mate license (10GE I/O Disabled) is not  compatible with my license (10GE I/O Enabled).
The output of show version< /cmdbold> command does not list  10GE I/O as an available feature.

Workaround:
Downgrade to 8.2(2) software.

Thanks

[Jennifer Halim]

Seems like there are a number of bugs, and as long as you are not running the ASA 8.2.3 version.

So the workaround is to either downgrade it to 8.2.2 or as Kureli pointed out to upgrade to interim version of 8.2.3(4).