Hi, thank you for your reply!   I am also noticing 4m + assoc time which is very long!   Re latency, it's a switched network, with routed SVI's and STP pruning - not seeing any other latency issues.  Also, there are other WAPs in the saubnet and switch, of other model types and not seeing the same issue on these.... ... View more

Further info...   On the WLC, I have ran the command; show ap join stats detailed #MAC#   Output: - Reason for last AP connection failure.................... Number of message retransmission to the AP has reached maximum - Last AP disconnect reason................................ Unknown failure reason Last join error summary - Type of error that occurred last......................... AP got or has been disconnected - Reason for error that occurred last...................... Number of message retransmission to the AP has reached maximum - Time at which the last join error occurred............... Oct 06 12:42:28.077 AP disconnect details - Reason for last AP connection failure.................... Number of message retransmission to the AP has reached maximum  Ethernet Mac : #;#;#;#;#;#;  Ip Address : #.#.#.#   Output indicates it's related to a max number of retransmissions  to the WAP!          ......I have upped to the max (8) to see what happens but I don't want to have to do this if there's an underlying fault. ... View more

Good call, thanks Marvin! ... View more

Sorry, I am bombarding you!! OK, so now I have cleared (logout) the VPN on both the active and standby ASA's (within the context) and the VPN has now come up by itself and is incrementing (viewing on the standby ASA where the context is active)..... so looking OK so far.... ... View more

I am actually receiving the following log messages on the standby firewall, admin context: 720012 (VPN-Secondary) Failed to update IPSec failover runtime data on the standby unit http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html#errcosmet There was a similar bug, which was fixed before v9. If I clear the VPN down while active on the standby ASA, the VPN still does not initiate.  ... View more

2017-04-11 12:28:56    Local4.Error    *.*.*.*    %ASA-3-336013: Route <016>, 951597600 successors, 2 rdbs 2017-04-11 12:28:56    Local4.Error    *.*.*.*    %ASA-3-336013: Route <016>, 951597600 successors, 2 rdbs 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-713906: IKE Receiver: Packet received on *.*.*.*:500 from *.*.*.*:500 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-720041: (VPN-Secondary) Sending Sync IKEV2 Parent Msg ID message (IKEv2 Msg ID 75) to standby unit 2017-04-11 12:27:16    Local4.Info    *.*.*.*    %ASA-6-302021: Teardown ICMP connection for faddr *.*.254.153/0 gaddr *.*.*.*/130 laddr *.*.*.*/130 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-751003: Local:*.*.*.*:500 Remote:*.*.*.*:500 Username:*.*.*.* IKEv2 Need to send a DPD message to peer 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-713906: IKE Receiver: Packet received on *.*.*.*:500 from *.*.*.*:500 2017-04-11 12:27:16    Local4.Debug    *.*.*.*    %ASA-7-720041: (VPN-Secondary) Sending Sync IKEV2 Parent Msg ID message (IKEv2 Msg ID 75) to standby unit ... View more

Thank you Marvin. Apologies, I should have confirmed, IOS is 9.2(2)4 Strangely, no logging is appearing after failing over (so the context logging is not carried over, although you can ASDM to it) Will have a look at setting up a capture... ... View more

PS: > The trunk port which the anchor is connected to permits all VLANs. > IP Gateway/network on DHCP scope is correct. > Tried entering the DHCP server in the interface config and also tried entering it's own IP address, to try to use local DHCP scope on WLC > Microsoft DHCP server is used to serve other roaming clients on another WLC Anchor I have, this anchor is in 'Old Mobility Mode' and this one is in 'New Mobility Mode', as this remote site's WLC is operating in this mode.  Therefore I can't use my existing WLC.  However, our DHCP server should be supported and confogured correctly. ... View more