ASA interfaces bounced due to a wr mem

[mortojjesse]

One line of an ACL was changed on an ASA 5520 (primary) and a wr mem was issued to save the change. It appears that when the wr mem was executed, the interfaced on the standby ASA bounced.

Can someone help me to understand why this would've happened? Configurations have been saved in the past without the result of what's in the log entry..

Thank you.

ADC-5520-MGMT-FW01/stby# show log
Syslog logging: enabled
    Facility: 22
    Timestamp logging: enabled
    Standby logging: enabled
    Debug-trace logging: disabled
    Console logging: level errors, 1203060 messages logged
    Monitor logging: level errors, 1203060 messages logged
    Buffer logging: level errors, 17590658 messages logged
    Trap logging: level informational, facility 22, 450126258 messages logged
        Logging to management 10.5.3.214
        Logging to management 10.142.20.214
        Logging to management 10.218.3.31
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: level informational, 464351755 messages logged
Sep 21 2011 17:35:29: %ASA-1-709006: (Primary) End Configuration Replication (STB)
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface management
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface staff-outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface Cert-outside
Sep 21 2011 17:35:44: %ASA-1-105006: (Primary) Link status 'Up' on interface QA-outside
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface management waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface staff-outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface Cert-outside waiting
Sep 21 2011 17:35:51: %ASA-1-105003: (Primary) Monitoring on interface QA-outside waiting
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface management normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface staff-outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface Cert-outside normal
Sep 21 2011 17:36:06: %ASA-1-105004: (Primary) Monitoring on interface QA-outside normal
ADC-5520-MGMT-FW01/stby#    show clock
17:50:25.768 CDT Wed Sep 21 2011

DC-5520-MGMT-FW01/act# show log

Syslog logging: enabled

    Facility: 22

    Timestamp logging: enabled

    Standby logging: enabled

    Debug-trace logging: disabled

    Console logging: level errors, 1787 messages logged

    Monitor logging: level errors, 1787 messages logged

    Buffer logging: level errors, 6894376 messages logged

    Trap logging: level informational, facility 22, 258217070 messages logged

        Logging to management 10.5.3.214 errors: 85753  dropped: 603267

        Logging to management 10.142.20.214 errors: 43120  dropped: 682789

        Logging to management 10.218.3.31 errors: 8  dropped: 368

    History logging: disabled

    Device ID: disabled

    Mail logging: disabled

    ASDM logging: level informational, 258220730 messages logged

Sep 21 2011 17:35:18: %ASA-1-709003: (Secondary) Beginning configuration replication: Send to mate.

Sep 21 2011 17:35:30: %ASA-1-709004: (Secondary) End Configuration Replication (ACT)

[Julio Carvajal]

Hello Jesse,

Was this a Write memory or a Write Standby??

Regards,

[mortojjesse]

Thank you for your reply. Yes it was a wr mem.

thank you

[Julio Carvajal]

Just to let you know it is expected that when you issue the command  Write Standby that the failover or the stateful interface is going to  start bouncing. this because the Primary ASA is going to replicate the  entire configuration on the Stand by Unit, so while the Stand by unit is  being configured you are going to have the interface down. So you dont  have to worry about it.

That is why Cisco recommends to use the  command write memory instead of the Write stand by, with the Write  memory you are not goint to have this issue and you are going to have  the replication on the stand by as well.

This is why I asked you if you performed a Write Standby, but you did not.

-Now is this the first time this happen??

-Can you issue the command again and let me know if you receive the same log?

-Can you place the output of the Show failover , Sh failover statistics

Regards,

[mortojjesse]

Yes. This appears to be the first time this has happened. Is a wr stanby executed when executing a wr mem? Is that how the primary's config written to the standby? I'm thinking not. Otherwise we would see the interfaces flap everytime we write the config.

I can't execute a wr mem again as this is a production device and I am out of my change window. The interfaces are up and everything is operational. I am just confused as to why the interfaces on the standby bounced.

[Julio Carvajal]

You replicate the whole configuration to a stand by device with the Write standby, but afterwards by just executing the Write Memory you are going to have both devices synchronized.

The only way you will see them flapping will be with the Write Standby not with the Write Mem as I explained before.

Can you share the Show failover Statistics?

Regards,

[mortojjesse]

Thank you.

Here are the show fail stati

From the Active ASA
ADC-5520-MGMT-FW01/act# sh failover statistics

        tx:79087953

        rx:100398444 ADC-5520-MGMT-FW01/act# sh failover statistics
        tx:79087953
        rx:100398444

From the Primary ASA
ADC-5520-MGMT-FW01/stby# sh failover statistics
        tx:100399359
        rx:79088201

[mortojjesse]

ADC-5520-MGMT-FW01/act# sh failover statistics

        tx:79087953

        rx:100398444 ADC-5520-MGMT-FW01/act# sh failover statistics
        tx:79087953
        rx:100398444

ADC-5520-MGMT-FW01/act# sh failover
Failover On
Failover unit Secondary
Failover LAN Interface: failover GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 5 of 250 maximum
Version: Ours 8.2(1), Mate 8.2(1)
Last Failover at: 18:28:49 CDT Jul 16 2011
        This host: Secondary - Active
                Active time: 5802139 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.13): Normal
                  Interface outside (10.180.3.1): Normal
                  Interface staff-outside (10.143.27.1): Normal
                  Interface QA-outside (10.129.14.1): Normal
                  Interface Cert-outside (10.132.36.1): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
        Other host: Primary - Standby Ready
                Active time: 39994111 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.14): Normal
                  Interface outside (10.180.3.2): Normal
                  Interface staff-outside (10.143.27.2): Normal
                  Interface QA-outside (10.129.14.2): Normal
                  Interface Cert-outside (10.132.36.2): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Stateful Failover Logical Update Statistics
        Link : failover GigabitEthernet0/3 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         173722393  0          441763955  1538
        sys cmd         6106312    0          6106311    0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        35820590   0          142079651  768
        UDP conn        126262857  0          272428431  563
        ARP tbl         5532634    0          21149562   207
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       59      481762820
        Xmit Q:         0       1024    179527426

[mortojjesse]

This output from the standby:

ADC-5520-MGMT-FW01/stby# sh failover statistics
        tx:100399359
        rx:79088201
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby#
ADC-5520-MGMT-FW01/stby# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: failover GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 5 of 250 maximum
Version: Ours 8.2(1), Mate 8.2(1)
Last Failover at: 18:28:46 CDT Jul 16 2011
        This host: Primary - Standby Ready
                Active time: 39994111 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.14): Normal
                  Interface outside (10.180.3.2): Normal
                  Interface staff-outside (10.143.27.2): Normal
                  Interface Cert-outside (10.132.36.2): Normal
                  Interface QA-outside (10.129.14.2): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
        Other host: Secondary - Active
                Active time: 5802537 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/8.2(1)) status (Up Sys)
                  Interface management (10.143.67.13): Normal
                  Interface outside (10.180.3.1): Normal
                  Interface staff-outside (10.143.27.1): Normal
                  Interface Cert-outside (10.132.36.1): Normal
                  Interface QA-outside (10.129.14.1): Normal
                slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)

Stateful Failover Logical Update Statistics
        Link : failover GigabitEthernet0/3 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         931683832  4          97293586   670
        sys cmd         6106366    0          6106364    0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        144282242  0          35540883   311
        UDP conn        760145434  0          50113517   174
        ARP tbl         21149790   4          5532822    185
        Xlate_Timeout   0          0          0          0
        VPN IKE upd     0          0          0          0
        VPN IPSEC upd   0          0          0          0
        VPN CTCP upd    0          0          0          0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0

        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       50      103099200
        Xmit Q:         0       1024    971682964

[Julio Carvajal · Accepted solution]

Maybe it was because because the configuration was replicated to the Standby Unit and while the Active unit was writting this configuration, the failover  interface went down for one or 2 seconds, but this is nothing to worry about it.

If you keep having these errors there is a workaround and that is if you have a switch between the failover units to configure the ports connected to the ASA units as Switchport Portfast, so they come up faster when a replication is made.

Hope this Help you.

Regards,

Julio

[mortojjesse]

Thank you. And thank you for taking the time to work on my question. During my next change window, I am going to replicate the event.

Your time is greatly appreciated.

Jesse

[Julio Carvajal]

Hello Jesse,

It is my pleasure, any other question you have just let me know. I will be more than glad to help you

Have a great day,

Julio