AnyConnect & ISAKMP1 respond on outside interface of secondary firewall

[gchevalley]

We have two ASA 5510 firewalls configured for stateful active-standby failover.  During recent external threat scans we noticed vulnerabilities listed for both primary and secondary firewalls.  Usually we only see the primary listed as it should be the only one responding on the outside interface.  Has anyone else encountered this issue.

ASA version is 9.1(5)21

Failover configuration:

failover

failover lan unit primary

failover lan interface FAILOVER Management0/0

failover key *****

failover replication http

failover link FAILOVER Management0/0

failover interface ip FAILOVER 169.254.252.5 255.255.255.252 standby 169.254.252.6

[Richard Bradfield]

Hi,

I think you will find all the Interfaces of the Standby ASA are up, I definitely see the IP address on my connected routers when I do a "show ip arp"

Why would you bother with a Failover address if the interface was not up?

HTH

Richard

[gchevalley]

The interfaces on both the primary and secondary firewall's are up but only the active firewall should respond to traffic on anything other than the interface designated as management.  In my case we are using the inside interface for management so it should respond on both firewalls.  All of the other interfaces on the secondary non-active firewall shouldn't respond but yet the outside interface is.  Performing a port scan against the outside secondary IP address should show no results; it should be silent.  Instead It is behaving as if they were in an active-active failover pair instead of an active/secondary pair.

[Richard Bradfield]

I just checked out my ASAs and from the Internet router and I can ping the standby ASA public interface., in the failover configuration I do monitor the outside interfaces.

this is my failover config

failover
failover lan unit primary
failover lan interface Failover Management0/0
failover polltime unit 10 holdtime 30
failover interface-policy 2
failover key *****
failover replication http
failover link Failover Management0/0
failover interface ip Failover 10.250.206.73 255.255.255.252 standby 10.250.206.74