ASA Failover

[sameermunj]

Hi experts

My network setup has 2 number for ASA 5520 firewall configured in as Active-Standby setup.(ASA Version 8.2(1) )..One of the firewall is configured as Active and other is Standby..Recently we experienced automatic failover without any boot/failure of primary firewall or without any physical communication issue.The primary firewall was working fine still the failover has happened and standby firewall has become active..

From the documentation i could found following reasons for the failover...

• The unit has a hardware failure or a power failure.

• The unit has a software failure.
• Too many monitored interfaces fail.
• The no failover active command is entered on the active unit, or the failover active command is entered on standby unit.

Is there any other reason for the failover apart from 4 mentioned above....Setup is working fine and jsut want to understand the cause for the failover..

[Jennifer Halim]

You can check the reason why the failover occured by issueing the command: show failover history

Here is the command reference for more information:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s3.html#wp1474400

Hope that helps to determine the possible issue.

[sameermunj]

Hello

Thanks for the quick reply..

Please find below the output of show history

------------------ show failover history ------------------

==========================================================================

From State                 To State                   Reason

==========================================================================

09:49:40 IST Oct 8 2010

Standby Ready              Just Active                Other unit wants me Active

09:49:40 IST Oct 8 2010

Just Active                Active Drain               Other unit wants me Active

09:49:40 IST Oct 8 2010

Active Drain               Active Applying Config     Other unit wants me Active

09:49:40 IST Oct 8 2010

Active Applying Config     Active Config Applied      Other unit wants me Active

09:49:40 IST Oct 8 2010

Active Config Applied      Active                     Other unit wants me Active

04:06:18 IST Oct 9 2010

Active                     Failed                     Interface check

04:06:35 IST Oct 9 2010

Failed                     Standby Ready              Interface check

07:47:30 IST Oct 9 2010

Standby Ready              Failed                     Interface check

07:47:33 IST Oct 9 2010

Failed                     Standby Ready              Interface check

07:47:43 IST Oct 9 2010

Standby Ready              Failed                     Interface check

07:48:00 IST Oct 9 2010

Failed                     Standby Ready              Interface check

15:57:58 IST Oct 10 2010

Standby Ready              Failed                     Interface check

15:58:15 IST Oct 10 2010

Failed                     Standby Ready              Interface check

16:01:13 IST Oct 10 2010

Standby Ready              Failed                     Interface check

16:01:15 IST Oct 10 2010

Failed                     Standby Ready              Interface check

06:28:09 IST Oct 11 2010

Standby Ready              Just Active                Other unit wants me Active

06:28:09 IST Oct 11 2010

Just Active                Active Drain               Other unit wants me Active

06:28:09 IST Oct 11 2010

Active Drain               Active Applying Config     Other unit wants me Active

06:28:09 IST Oct 11 2010

Active Applying Config     Active Config Applied      Other unit wants me Active

06:28:09 IST Oct 11 2010

Active Config Applied      Active                     Other unit wants me Active

==========================================================================

it looks the connectivity issue happening since last 3 days but the final faiolver reason for today morning is not clear..

can you please help me in understanding the excat reason..

[Jennifer Halim]

Looks like it failed because of interface failure. Can you also post the output of "show failover" from both units.

Also check each interfaces on the ASA firewalls, both physical cable as well as connection to the switch port. One of the interfaces could have failed, hence causing the issue.

[alexandravidojevic]

Hi there,

All monitored interface must be in "Normal" state.

If only one or more monitored interaces are "Failed" for any reason and Secondary unit will be "Failed" or most of time except short intervals being "Standby Ready".

You can test this option by typing in cfg mode  "no monitor-interace NAME_OF_FAILED_INT" after that Secondary unit has to be "Standby Ready"

[alexandravidojevic]

Hi there,

All monitored interface must be in "Normal" state.

If only one or more monitored interaces are "Failed" for any reason and Secondary unit will be "Failed" or most of time except short intervals being "Standby Ready".

You can test this option by typing in cfg mode  "no monitor-interace NAME_OF_FAILED_INT" after that Secondary unit has to be "Standby Ready"