Hi All,
We are running on ASA version 8.2(2) using ASA in Active-Standby setup. As observed if issued 'write standby' command on active ASA the standby ASA network traffic interfaces are flapping (as observed in syslog messages the line protocol flap messages). Also observed error message 'configuration mismatch' in output of 'show failover history' command.
Please help us to know if some one is facing the same problem and what could be done to fix this behaviour.
Kindly let me know if any additional information is required to get further clarity on issue.
Regards,
Dulal
Hi,
Can you paste the output of the below commands on both the firewalls(active and standby)
#sh run | i failover
#sh failover status
Regards
Karuppu
Hi Karuppu,
Please find your req o/p as below :
Primary
Hostname# sh run | i failover
failover
failover lan unit primary
failover lan interface failover GigabitEthernet0/3
failover polltime unit 2 holdtime 10
failover key *****
failover replication http
failover link failover GigabitEthernet0/3
failover interface ip failover 192.168.1.1 255.255.255.252 standby 192.168.1.2
Secondary
Hostname# sh run | i failover
failover
failover lan unit secondary
failover lan interface failover GigabitEthernet0/3
failover polltime unit 2 holdtime 10
failover key *****
failover replication http
failover link failover GigabitEthernet0/3
failover interface ip failover 192.168.1.1 255.255.255.252 standby 192.168.1.2
sh failover status wont supported so captured sh failover state
Primary
Hostname# sh failover state
State Last Failure Reason Date/Time
This host - Primary
Active Ifc Failure 16:52:23 IST May 23 2010
Inside: No Link
Other host - Secondary
Standby Ready Ifc Failure 10:21:04 IST Jun 21 2010
Inside: Failed
====Configuration State===
Sync Done
Sync Done - STANDBY
====Communication State===
Mac set
Secondary
Hostname# sh failover state
State Last Failure Reason Date/Time
This host - Secondary
Standby Ready Ifc Failure 10:21:04 IST Jun 21 2010
Other host - Primary
Active Ifc Failure 16:52:23 IST May 23 2010
====Configuration State===
Sync Done
Sync Done - STANDBY
====Communication State===
Mac set
Let me know if req more inputs.
Prakash
Hi Dulal,
As per your problem description:
We are running on ASA version 8.2(2) using ASA in Active-Standby setup. As observed if issued 'write standby' command on active ASA the standby ASA network traffic interfaces are flapping (as observed in syslog messages the line protocol flap messages).
As per my understanding this is expected because when you issue 'write standby' command all the configuration from standby asa is removed and added again from the active unit, which will result in loss of connectivity to the standby ASA.
Your second question:
Also observed error message 'configuration mismatch' in output of 'show failover history' command.
This is only possible if you have made any config. change on the standby unit by mistake.
Regards
Harsh
Hello Harsh,
thanks for your response.
The software (IOS) which was currently running on both of the devices are recently changed (i.e. four months back when this issue noted). Prior to same which 8.1 series there was not interface flactuations during execution of wr standby on primary... so make us wonder how suddenly this behaviour changed.
for Point 2, we have erased config on secondary unit and rebuild pair again (i.e. sync) but its remains same and config was end to end verified on both units but no specific findings.
Let me know if you require more inputs.
Hi Prakash,
Did you find the problem?
Can you please share how you resolved this issue?
Thanks
Harsh
Hello Harsh,
Problem is still there however it is not impacting traffic flow as flactuations happening on standby f/w.
However the understanding as druing wr standby firwall again reapply config on standby mate due to replication of new config its interfaces are flactuating ..... u can assue how ur production router/switch behaves while applying command copy start run.
Thanks
Prakash
Hi,
I belive one time your standby unit became as primary. I belive by restarting the secandary this can be resolved. There wont be any impact for live traffic and you can test any time.