dot1x-ev:DOT1X Supplicant not enabled on FastEthernet0/3   Interface Fast0/3  dot1x pae auth  authentication port control auto  authentication order mab dot1x  authentication prio dot1x mab  authentication host-mode multi-auth   (only in case if you on vmware workstation etc.)       ... View more

i also noted your port-channel 2 is missing the ip address too. Which make sense but you missing the standby ip addres which is why your active passive not working properly.     FW-1 Port-channel2 10.112.1.4 YES CONFIG up up   FW-2 Port-channel2 unassigned YES CONFIG up up     and looking into your configuation you have used the same ip address twice.   FW2 ! interface Port-channel2 lacp max-bundle 8 nameif YYY security-level 1 ip address 10.112.1.4 255.255.255.0   --- FW-1 ! interface Port-channel2 lacp max-bundle 8 nameif YYY security-level 1 ip address 10.112.1.4 255.255.255.0   ... View more

Hi you have problem with your failover config on setup. you need to give standby ip address to those interface which you are monitoing.  if you put the config site by site of the show failover you will see the ip addres are not seen on the other box which is why you having this issue. ! Version: Ours 9.5(2), Mate 9.5(2) Last Failover at: 13:37:34 UTC Mar 10 2019 This host: Primary - Standby Ready Active time: 16 (sec) slot 0: ASA5512 hw/sw rev (1.0/9.5(2)) status (Up Sys) Interface management (0.0.0.0): No Link (Not-Monitored) Interface XXX (10.111.4.9): Normal (Monitored) Interface YYY (0.0.0.0): Normal (Not-Monitored) slot 1: SFR5512 hw/sw rev (N/A/5.3.1-152) status (Up/Up) ASA FirePOWER, 5.3.1-152, Up, (Monitored) Other host: Secondary - Active Active time: 198 (sec) slot 0: ASA5512 hw/sw rev (1.0/9.5(2)) status (Up Sys) Interface management (192.168.1.1): Normal (Not-Monitored) Interface XXX (10.111.4.10): Normal (Monitored) Interface YYY (10.112.1.4): Normal (Not-Monitored) slot 1: SFR5512 hw/sw rev (N/A/5.3.1-152) status (Up/Up) ASA FirePOWER, 5.3.1-152, Up, (Monitored) ... View more

"Ifc Failure" means interfce failure. could you try to change the cable or what else you can do is run ping from one asa to other asa example FW-2 ping to FW-1 failover ip address. in between these two ASA is there any switch? if so look at the switch config. or they connted back to back?   are you using the context in your box. if you than make changes to this. now if you have two context as Context1=group 1 and Context 2 = group2  than,   ! failover lan unit prim failover lan interface FO gig0/2 failover link STATE gig0/2 failover interface ip FO 192.168.1.1 255.255.255.0 sta 192.168.1.2 failover interface ip STATE 192.168.2.1 255.255.255.0 192.168.2.2 failover group 1   prim   pre failover group 2  sec  pre ! ... View more

I kind of disagree with you. by default interface are in monitor mode when you configure the failover configuration on the box. unless the interfaces are in sub-interface than yes. need to give command on the cli to monitor these interface/s ... View more

can you show what config you have on both switches for the failover. seems to me some inconsistent configuration at switches side where the failover config are setup. ... View more

if you have budget and resource in that case with deployment of 5500-x model with FMC. The FMC will manage the sfr module (firepower sensor module in ASA) via FMC as a central point of contact to push different policy for different ASA box (in case if you have more than one ASA).   but if no budget  and only 1xASA with SFR than this depends you can manage the SFR from the ASDM.   there is no recommendation all depends what is your requirement.  if you have a vmware esxi running than you can install the vFMC and mange the boxes. having said that one more point. the SFR in ASA use traditional lic as compare with FTD they need smart lic. ... View more

with firepower and ASDM only downside is there is no network discovery function available in ASDM. ... View more

@Marvin Rhoads  if https is working as it was confirmed that he had access to ASDM than it means the key are generated. i am curious how is is accessing the ASDM. i am under the impression the ASDM is access able if you only enable the https only.   ! http server enable http 0.0.0.0 0.0.0.0 mgmt ! now if these above command are configured he will have access to ASDM even without doing the config of local username. having said that if you check the logs he showed. their is unknow username. which point there is no local database configured   ... View more

have to define a local user on ASA.   username admin priv 15 password cisco123 ... View more

apologies i overlooked you syslog you paste earlier.   this seem to be an issue with you natting for this vpn   4|Feb 28 2019 10:01:53|402116: IPSEC: Received an ESP packet (SPI= 0x41AD96C1, sequence number= 0x17BF) from 35.176.80.84 (user= 65.176.80.84) to 95.12.22.33. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as 10.20.4.1, its source as 192.168.142.25, and its protocol as icmp. The SA specifies its local proxy as 10.99.206.0/255.255.255.0/ip/0 and its remote_proxy as 192.168.142.0/255.255.255.0/ip/0.   shall get back to you.   ... View more

try this command   hostname(config)# policy-map type inspect IPSec-pass-thr ... View more

        Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- 0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515 FCH191276LW ips ASA 5515-X IPS Security Services Processor ASA5515-IPS FCH191276LW cxsc Unknown N/A FCH191276LW sfr Unknown N/A FCH191276LW   ! sfr Unknown No Image Present Not Applicable     from your output above seem it has not sfr in it. if you have a cisco service contract in place you can download the images form cisco.   here is the link how to install it https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html ... View more