Need to Reload Primary Core ASA in HA cluster without causing downtime

[Dean Romanelli]

Hi All,

I have a clusted set of ASA 5520's in my data center, and I need to reload the primary unit asap without causing downtime.

Is there a way I can fail-over to the standby ASA 5520 in the cluster (with no interruption), issue a command to reload the primary unit, then fail back to primary once it is up, all without causing any downtime at any part of the process?

[Mark Malone · Accepted solution]

Make sure your in active/standby mode between the 2 ASAs , check the show failover is set correctly , if thats setup then you will only drop a couple of pings the failover is very quick , dropped my primary earlier to update the ios had a constant ping running was maybe 1-2 second drop , no users even noticed it but your config needs to be correct

[Dean Romanelli]

Hi Mark,

Thanks. After review I believe it is set up correctly, but another set of eyes wouldn't hurt. Here is the existing config (I didn't set this up personally). If you would, could you have a look?

failover
failover lan unit primary
failover lan interface failover Management0/0
failover mac address GigabitEthernet0/0 0000.0100.0001 0000.0100.0002
failover mac address GigabitEthernet0/1 0000.0100.0011 0000.0100.0012
failover mac address GigabitEthernet0/2 0000.0100.0021 0000.0100.0022
failover link statefailover GigabitEthernet0/3
failover interface ip failover 1.1.1.1 255.255.255.252 standby 1.1.1.2
failover interface ip statefailover 1.1.1.5 255.255.255.252 standby 1.1.1.6

FWCore-INET5520# show fail
Failover On
Failover unit Primary
Failover LAN Interface: failover Management0/0 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 160 maximum
Version: Ours 9.1(5)21, Mate 9.1(5)21
Last Failover at: 20:25:37 GMT/BST Jan 21 2015
        This host: Primary - Active
                Active time: 9745642 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
                  Interface outside (109.xxx.xxx.164): Normal (Monitored)
                  Interface inside (192.168.123.2): Normal (Monitored)
                  Interface dmz (192.168.122.1): Normal (Monitored)
                slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
                  IPS, 7.0(7)E4, Not Applicable
        Other host: Secondary - Standby Ready
                Active time: 373 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
                  Interface outside (-INET-GW): Normal (Monitored)
                  Interface inside (192.168.123.3): Normal (Monitored)
                  Interface dmz (192.168.122.2): Normal (Monitored)
                slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
                  IPS, 7.0(7)E4, Not Applicable

[Mark Malone]

Yes thats looks good , the fw your on is the primary and its active and the secondary is ready to take over

When you issue reload the ASA will fail to the secondary 192.168.123.3 fw ,  make sure to save your config 1st just in case

 This host: Primary - Active
                Active time: 9745642 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
                  Interface outside (109.xxx.xxx.164): Normal (Monitored)
                  Interface inside (192.168.123.2): Normal (Monitored)
                  Interface dmz (192.168.122.1): Normal (Monitored)
                slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
                  IPS, 7.0(7)E4, Not Applicable
        Other host: Secondary - Standby Ready
                Active time: 373 (sec)
                slot 0: ASA5520 hw/sw rev (2.0/9.1(5)21) status (Up Sys)
                  Interface outside (-INET-GW): Normal (Monitored)
                  Interface inside (192.168.123.3): Normal (Monitored)
                  Interface dmz (192.168.122.2): Normal (Monitored)
                slot 1: ASA-SSM-10 hw/sw rev (1.0/7.0(7)E4) status (Unresponsive/Up)
                  IPS, 7.0(7)E4, Not Applicable

[Dean Romanelli]

Thanks again Mark.

So just to confirm, all I need to do is type "reload" while on the primary firewall and it will failover?

I don't need to manually fail myself over to secondary and then reload primary from there?

[Mark Malone]

Yes exactly when you do that if you log into the 2nd firewall currently the backup you will see it has become the primary active and the asa you just set to reload becomes standby ready , you would then reload again on the current primary which was originally your backup to flip it back, it's a bit confusing but there is logic behind it just keep checking your show fail over outputs to confirm it's worked  

[Dean Romanelli]

Thanks Mark.