Failover mate failed on ASA services module

[Colin Higgins]

I have two ASA service modules running in a Catalyst 6513-E switch.

While upgrading the OS on these from 9.24.33 to 9.64 I receive a message saying that the operating systems are different (which is expected) and the configuration is being sent to the mate (also expected)

but when I do a "show failover", the standby unit is listed as failed. The OS running on it is listed as 9.64 but I can't administer it. Everything is in status "unknown"

I tried to reboot it using failover exec, but it comes back as 9.64 and in a failed state

has anyone seen this? What is the workaround?

[Abdullo Salikhov]

Can you share what steps exactly you have done to upgrade the OS version ?

[Marvin Rhoads]

Can you console into the secondary ASA-SM and share the output of "show failover"?

[Colin Higgins]

marvin:

since this is a asa services module, I had to try and session into the secondary device from the switch (no console port)

service-module session switch 2 slot 9

but it was unresponsive. The status for the card was listed as "other"

So I took the card out and put it into another 6500 series switch. I was then able to session in no problem. It was running 9.6.4, so I set it to boot from 9.2.4. I then put it back into the original switch and it came right up. The two ASAs synched up without issue.

So what was happening was that when the secondary unit came up with 9.6.4 running, and the primary tried to synch to it, the whole blade would crash. I'm not sure why this was happening (the model is WS-SVC-ASASM-1). It was like the system doesn't like 9.6.4

I am wondering if anyone else has seen this, or if there is some compatibility issue I am unaware of?

[Marvin Rhoads · Accepted solution]

There are a few caveats listed here:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_65978

If you meet those then it should work.

There may be a bug you'r hitting that I'm not immediately aware of. A TAC case would be the best bet to verify that as they can check even for non-public bugs.

[Colin Higgins]

the 6513-E (with supervisor 2T) is running 15.1(1) SY1

so according to the matrix, that should work

I will check with the TAC and see if there is some bug involved

thanks