Cisco ASA 5525 with SFR module, "Service card in other unit has failed"

[shrinad146]

Dear All,

I have a cisco ASA 5525x with SFR software module installed on it. We were facing the issue of failover not happening. but yesterday all of a sudden we started getting below messages :

VPUN1-FW01# sh failover history
==========================================================================
From State To State Reason
==========================================================================
15:58:53 CST Dec 12 2015
Standby Ready Just Active Other unit wants me Active

15:58:53 CST Dec 12 2015
Just Active Active Drain Other unit wants me Active

15:58:53 CST Dec 12 2015
Active Drain Active Applying Config Other unit wants me Active

15:58:53 CST Dec 12 2015
Active Applying Config Active Config Applied Other unit wants me Active

15:58:53 CST Dec 12 2015
Active Config Applied Active Other unit wants me Active

16:02:29 CST Dec 12 2015
Active Standby Ready Set by the config command

13:45:49 CST Jan 11 2016
Standby Ready Failed Interface check

13:45:54 CST Jan 11 2016
Failed Standby Ready Interface check

13:46:00 CST Jan 11 2016
Standby Ready Just Active Other unit wants me Active

13:46:00 CST Jan 11 2016
Just Active Active Drain Other unit wants me Active

13:46:00 CST Jan 11 2016
Active Drain Active Applying Config Other unit wants me Active

13:46:00 CST Jan 11 2016
Active Applying Config Active Config Applied Other unit wants me Active

13:46:00 CST Jan 11 2016
Active Config Applied Active Other unit wants me Active

13:55:34 CST Jan 11 2016
Active Standby Ready Other unit wants me Standby

01:51:02 CST Jan 14 2016
Standby Ready Just Active Service card in other unit has failed

01:51:02 CST Jan 14 2016
Just Active Active Drain Service card in other unit has failed

01:51:02 CST Jan 14 2016
Active Drain Active Applying Config Service card in other unit has failed

01:51:02 CST Jan 14 2016
Active Applying Config Active Config Applied Service card in other unit has failed

01:51:02 CST Jan 14 2016
Active Config Applied Active Service card in other unit has failed

02:21:52 CST Jan 14 2016
Active Standby Ready Other unit wants me Standby

==========================================================================

Have gone through the threads for ssm and cx module as well ?? any idea for this as well?? 

currently my os version is asa922-4-smp-k8.bin

[Aaron O'Hare]

If you are running the SFR have you completely removed the other service modules? (i.e. CX)

I've had ASAs failover when they are still present and not being used.

Also, are both of your SFRs installed and running? If you aren't using SFR services actively then remove it, you can always re-add it later.

AJ

[shrinad146]

Hi,

As checked we are able to do the failover  successfully , but the issue we are facing is we are able to reach the internet and the dmz segment from the ASA itself, but when we try to reach the internet on outside interface and dmz servers on the dmz interface from the secondary asa is working but when we do a failover and shift traffic to a primary asa after failover the same is not happening.

can anyone suggest on this?? Also as checked with same configuration on secondary ASA it is working fine but when we come to primary asa after doing a failover everything stops working!!!! 

As observed on secondary ASA where everything is working we can see the flags in xlate table as

flags UxIO

and the same on primary asa after a failover is just UxI !!! it is strange because same is working on other ASA , where everything is same.