cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
351
Views
0
Helpful
2
Replies

Cisco ASA Firmwareupdate and Failover Problems

Hello people

I would appreciate if someone could have a look at my problem.

We are currently running two ASA 5510 in an active/standby configuration. And today somewhat strange happened.

Running firmware 841-11-k8 - planned to upgrade to 847-30-k8 because of CVE-2016-1287.

I planned to upgrade firmware on them. I've Uploaded the new firmware to the main, seit it to boot and THOUGHT I had done the same to the second unit and saved the config. I then noticed that I cant access the second unit and became aware of my mistake. Failover showed Primary as active and seconday as failed.

So I've conncted via console to the second unit and cleaned up my mess with the boot configuration. The device was then reloaded. Shortly after I reset the failover. Second unit saw the primary again and replicated config. Failover state on the primary stated Primary active - Secondary Standby, everything worked fine again.

The whole night the cluster worked well until 07:00 AM this morning. The primary was again in failover state, seconday failed. LED on secondary stated that it was active! Internet access wasnt working, production VPN's on the primary was also down... Kind of a little desaster for a friday morning. As it was already pretty busy I powered off the secondary and reloaded the primary unit. Everythings fine again. Except the fact that Im still running the old firmware and the failover seems to be broken.

As I've reloaded both unites I guess the log files are lost and I've had no chance to investigate. Im a bit uncertain about setting the failover back up because it was running the whole night and just in the morning it blew up everything - for no obvious reason. So my question is: have you any idea what could have happened? Which further information am I able to provide you so that you can help me?

Advice would be very appreciated!

Ben

2 Replies 2

Marvin Rhoads
Hall of Fame
Hall of Fame

The command

show failover history

...will tell you what the units' cause for doing failover was. It's independent of the logging buffer so the history should still be there.

Thank you for your reply. Unfortunately the history is completely empty. I also wonder why the failover event caused the whole internet connection to break rendering both asa's useless until one was powered off.

My read is I have to set it up again to figure out what happened. Unsatisfying.

Regards

Review Cisco Networking for a $25 gift card