ASA in HA

[Anukalp S]

 Hi,

I have been running cisco ASA 5525 ver 9.1(2) in HA mode,  primary is active and secondary is standby.

I have configured below ip configuration on inside interface.

interface GigabitEthernet0/1
 description ####LAN ####
 nameif inside
 security-level 100
 ip address 192.168.117.1 255.255.255.0 standby 192.168.117.2

Problem is that i am able to ping 192.168.117.1 but not able to ping 192.168.117.2 from any where in LAN.

Pls help me where could be issue.
 

[Karsten Iwen]

Doublecheck the switch port where the secondary ASA is connected. It should have the same settings as the port for the inside interface of the primary ASA. And what is the output of "show failover"? Is everything ok there?

[Anukalp S]

 Hi,

I have checked switch port where secondary ASA is connected, it has same setting as for primary ASA switch port. ASAs are connected to core switch running VSS.

Failover On
Failover unit Primary
Failover LAN Interface: failoverlink GigabitEthernet0/7 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 5 of 216 maximum
failover replication http
Version: Ours 9.1(2), Mate 9.1(2)
Last Failover at: 07:40:24 UTC Jul 13 2014
        This host: Primary - Active
                Active time: 1128773 (sec)
                slot 0: ASA5525 hw/sw rev (1.0/9.1(2)) status (Up Sys)
                  Interface outside (103.254.236.5): Normal (Monitored)
                  Interface inside (192.168.197.1): Normal (Monitored)
                  Interface dmz (192.168.194.1): Normal (Monitored)
                  Interface wireless (192.168.200.1): Normal (Monitored)
                  Interface outside2 (103.254.237.5): Normal (Monitored)
        Other host: Secondary - Standby Ready
                Active time: 0 (sec)
                slot 0: ASA5525 hw/sw rev (1.0/9.1(2)) status (Up Sys)
                  Interface outside (103.254.236.4): Normal (Monitored)
                  Interface inside (192.168.197.2): Normal (Monitored)
                  Interface dmz (192.168.194.2): Normal (Monitored)
                  Interface wireless (192.168.200.2): Normal (Monitored)
                  Interface outside2 (103.254.237.4): Normal (Monitored)

Stateful Failover Logical Update Statistics
        Link : stateful GigabitEthernet0/6 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         161507155  2          443917     3047
        sys cmd         394858     1          394856     0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        99483145   0          12001      0
        UDP conn        56463613   0          31724      0
        ARP tbl         3622904    1          4553       0
        Xlate_Timeout   0          0          0          0
        IPv6 ND tbl     0          0          0          0
        VPN IKEv1 SA    25064      0          39         0
        VPN IKEv1 P2    16874      0          30         0
        VPN IKEv2 SA    0          0          0          0
        VPN IKEv2 P2    0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     601853     0          0          0
        Route Session   898727     0          713        3047
        User-Identity   117        0          1          0
        CTS SGTNAME     0          0          0          0
        CTS PAC         0          0          0          0
        TrustSec-SXP    0          0          0          0
        IPv6 Route      0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       90      3420030
        Xmit Q:         0       2048    169265975

[nkarthikeyan]

Hi anukalp,

Inside interface details, what you have posted and your recent sh failover output shows a different one???

When we look on the status it shows everything seems to be fine.... you should be able to reach

192.168.197.2 from the LAN.

Do you see any logs in the vss switch?

Regards

Karthik