Asa failover problem

[erodrig]

hi

I have a problem with two asa 5545 connected failover, I generate a tunnel ipsec to asa1 (active) and it works correctly, but when the interface outside of asa1 is down, the asa 2 becomes active but the ipsec.tunnel dont goes up
i made this test, if I turn off the active asa, the failover works and the ipsec tunnel going up and there´s no problem

any ideas?
This is the network diagram

[Ajay Saini]

Hello,

Could you please check if outside interface is being monitored. Check the output of:

sh run monitor-interface

If the interface is not being monitored, failover would not happen if outside interface goes down and the tunnel would stay down.

-AJ

[erodrig]

Hi Ajay

the failover happen without problem when the outside interface goes down, but the tunnel stays down

here´s the ouptup 

ASA-VPN/act# sh running-config monitor-interface
ASA-VPN/act# sh running-config all monitor-interface
monitor-interface outside
monitor-interface inside
ASA-VPN/act# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: Fail-over GigabitEthernet0/6 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.2(2)4, Mate 9.2(2)4
Last Failover at: 17:59:08 CDT May 9 2017
This host: Primary - Active
Active time: 62997 (sec)
slot 0: ASA5545 hw/sw rev (1.0/9.2(2)4) status (Up Sys)
Interface outside (XXX.XXX.225.20): Normal (Monitored)
Interface inside (192.168.100.3): Normal (Monitored)
slot 1: SFR5545 hw/sw rev (N/A/5.4.0-764) status (Up/Up)
ASA FirePOWER, 5.4.0-764, Up
Other host: Secondary - Standby Ready
Active time: 111 (sec)
slot 0: ASA5545 hw/sw rev (1.0/9.2(2)4) status (Up Sys)
Interface outside (XXX.XXX.225.21): Normal (Monitored)
Interface inside (192.168.100.5): Normal (Monitored)
slot 1: SFR5545 hw/sw rev (N/A/5.4.0-764) status (Up/Up)
ASA FirePOWER, 5.4.0-764, Up

Stateful Failover Logical Update Statistics
Link : Statelink GigabitEthernet0/7 (up)
Stateful Obj xmit xerr rcv rerr
General 83689 0 162497 44
sys cmd 57136 0 57134 0
up time 0 0 0 0
RPC services 0 0 0 0
TCP conn 57 0 5 0
UDP conn 8774 0 47801 0
ARP tbl 17449 0 56686 0
Xlate_Timeout 0 0 0 0
IPv6 ND tbl 0 0 0 0
VPN IKEv1 SA 25 0 34 0
VPN IKEv1 P2 171 0 836 0
VPN IKEv2 SA 0 0 0 0
VPN IKEv2 P2 0 0 0 0
VPN CTCP upd 0 0 0 0
VPN SDI upd 0 0 0 0
VPN DHCP upd 0 0 0 0
SIP Session 0 0 0 0
Route Session 71 0 1 44
Router ID 0 0 0 0
User-Identity 6 0 0 0
CTS SGTNAME 0 0 0 0
CTS PAC 0 0 0 0
TrustSec-SXP 0 0 0 0
IPv6 Route 0 0 0 0
STS Table 0 0 0 0

Logical Update Queue Information
Cur Max Total
Recv Q: 0 17 1039050
Xmit Q: 0 36 167353
ASA-VPN/act#

thanks