ASA active / standby after failover

Similar Questions

• ASA (Active standby) site-to-Site VPN Question

  Hello

  I had the question as below

  Site A - 1 unit of VPN Netscreen firewall

  Site B - 2 units of ASA VPN firewall

  

  I'm trying to set up a VPN from Site to Site, but a problem with the configuration of the active standby.

  Initially, I tried Site A 1 unit Netscreen and Site B 1 unit ASA vpn site-to-site. There's no problem.

  but joins another ASA at site B and configure it as active / standby then I saw a few questions that I need help from here

  Things that confuse me.

  (1) do I need to use 2 public IP address on the SAA? (public IP for assets and the other a public IP ensures IP. it seems like a waste of the public IP address.)

  (2) link failover and dynamic failover can be configured on the same interface?

  Please help in this case, configuring VPN from Site to Site with active configuration / standby.

  just to add to this,

  just be careful when you dedicate an interface for dynamic failover, make sure that it is the highest capacity, or at least the same ability as an interface offers th

  so if you use concert for passing traffic interface uses a concert for dynamic failover port, several times we saw people using the management for steful interface when they ports of concert and they run into issues where the dynamic function does not work as expected

  You can read more here

  https://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/failover.html#wp1051759

• Cisco ASA active / standby Mac addresses

  Hi all

  Please advise on the underside.

  Say that I have to active / standby. I have two interfaces on each firewall configured as below

  For the primary (active)

  interface GigabitEthernet1 / 0--> Say burned in mac address is 6c41.6bb0.1111
  nameif test1
  security-level 0
  10.1.1.1 IP address 255.255.255.0 ensures 10.1.1.2

  im int 2/0

  Test2 nameif--> Say burned in mac address is 6c41.6aa0.1111
  security-level 0
  10.2.1.1 IP address 255.255.255.0 ensures 10.2.1.2

  For secondary school (currently idle)

  interface GigabitEthernet1 / 0--> Say burned in mac address is 6c41.6bb0.2222
  nameif test1
  security-level 0
  10.1.1.1 IP address 255.255.255.0 ensures 10.1.1.2

  im int 2/0

  Test2 nameif--> Say burned in mac address is 6c41.6aa0.2222
  security-level 0
  10.2.1.1 IP address 255.255.255.0 ensures 10.2.1.2

  According to my understanding of the DOC.

  To transfer traffic, other devices will use the main unit mac address and IP addresses.

  Please consider under the scenario:

  My primary unit has failed and secondary took over as active unit.

  Primary (standby)

  Secondary (active)

  secondary Q1) so now will use the IP address and Mac address as below? Please confirm

  10.1.1.1 & 6c41.6bb0.1111

  10.2.1.1 & 6c41.6aa0.1111

  Q2) I believe that the ip address of the primary (Standby) in aid will be

  10.1.1.2

  10.2.1.2

  It will use what mac addresses? What is the BIA of the secondary unit? Please notify

  Thanks in advance.

  Q1 Yes), IP address and the MAC will be moving to the new active unit so no matter who the network except the switch will notice failover event

  Q2) Yes, primary (watch now) will use IP addresses and MAC addresses available for secondary:

  6C41.6bb0.2222

  6C41.6aa0.2222

  Kind regards.

• Procedure to upgrade (Active-Standby) ASA

  Hi all

  I just want to check if our upgrade scheduled SAA causes no problems during the procedure.

  Material: ASA5525-X

  Existing IOS: 9.1.2

  Update to: 9.4.2 (11)

  Setup: Active standby

  We intend to be upgraded the first start, after that, is the day before still will to resume after we force a failover him so that we can then pass the main firewall.

  Thank you very much!

  Yes, it's the process. I did it several times it it works perfectly when you follow the documented procedure.

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

• Cisco ASA CX active / standby

  Hello friends

  One of my clients has a couple of ASA 5545 work quite well as active / standby failover. But the configuration that is not copied to the secondary unit is CX. Do you know how to get it? Please, do not hesitate to request further information, comment or document will be appreciated.

  Kind regards!

  The CX configurations are not part of the active reserve ASA replication.

  How to synchronize the configurations of CX is to use PRSM (first Security Manager - product under separate license, not the one provided with the CX) running on a virtual machine in device mode.

  Reference.

  Once you find out what pair CX with a PRSM "out of area", all configuration changes are deployed both to the pair.

• ASA 5520 Active standby and ssl vpn loadbalancing

  I have a pair of Asa 5520 failover active rescue running. Can I use these two machines in a cluster of ssl vpn load balancing?

  N ° when a couple active / standby is part of a cluster of VPN, the rescue unit is still pending - she will not be actively terminate user sessions. Only the active cluster members (and non-failover) will do.

• ASA 5520's active / standby, do not sync AnyConnect Profles

  I'm working on two ASA 5520 configuration in a configuration active / standby.  I have almost all the same between the two units for AnyConnect work waiting for both of the following:

  AnyConnect Client profiles

  AnyConnect Client software

  If I download the software manually to the standby unit I get warning against them are not synchronized, and on the active unit if I do a 'writing' standby does not copy the profile or the software.  Anyone has any ideas on this?

  Thank you

  Dan

  Hello

  Bug CSCsr31403

  When you configure the ASA in a failover pair, you must manually copy the AnyConnect and CSD images for the primary and the secondary ASA.   You must also do the same for the Anyconnect profile file if you use it.

  Either force the ASA shall become active and copy the files to the new ASA assets using ASDM or copy files directly from the console ASA ensures using tftp or ftp.

  Kind regards

  Note the useful messages

  Julio

• on the stateful failover active / standby

  Hello guys.

  I have two ASA, same model and material. ASA have configured stateful failover active / standby by someone a few years ago. It worked normally until recently and no one changed the configuration. Then the secondary unit can't. Ping between 2 interfaces is ok. Please help me solve this problem.

  on the main site

  interface Management0/0

  STATE failover Interface Description

  management only

  interface GigabitEthernet1/1

  Failover LAN Interface Description

  failover

  primary failover lan unit

  failover lan interface failover GigabitEthernet1/1

  The link with failover Management0/0 status

  failover failover interface ip 172.16.1.1 255.255.255.0 ensures 172.16.1.2

  State of the failover interface ip 172.16.0.1 255.255.255.0 ensures 172.16.0.2

  on the secondary site

  interface Management0/0

  STATE failover Interface Description

  management only

  interface GigabitEthernet1/1

  Failover LAN Interface Description

  output of the show failover on PRIMARY

  Show execution of failover

  failover

  primary failover lan unit

  failover lan interface failover GigabitEthernet1/1

  The link with failover Management0/0 status

  failover failover interface ip 172.16.1.1 255.255.255.0 ensures 172.16.1.2

  State of the failover interface ip 172.16.0.1 255.255.255.0 ensures 172.16.0.2

  See the resumption of F1 #.

  Failover on

  Unit of primary failover

  Failover LAN interface: GigabitEthernet1/1 failover (maximum)

  Frequency of survey unit 1 seconds, 15 seconds holding time

  Survey frequency interface 5 seconds, 25 seconds hold time

  1 political interface

  Monitored 5 256 maximum Interfaces

  Version: Our 8.2 (2), Matt 8.2 (2)

  Last failover to: 08:03:11 ULAST January 1, 2003

  This host: primary: enabled

  Activity time: 5755203 (s)

  slot 0: ASA5550 hw/sw rev (status 2.0/8.2(2)) (upward (Sys)

  Interface Backup2 (10.2.5.1): Normal (pending)

  Internet (202.131.225.90) interface: No link (pending)

  Interface Backup1 (10.3.5.1): Normal (pending)

  The interface server (192.168.227.1): Normal (pending)

  Bank interface (10.20.1.1): Normal (pending)

  Slot 1: rev hw/sw ASA-SSM-4GE-INC (State of 1.0/1.0(0)10) (top)

  Another host: secondary - failed

  Activity time: 0 (s)

  slot 0: ASA5550 hw/sw rev (status 2.0/8.2(2)) (upward (Sys)

  Backup2 (0.0.0.0) interface: no connection (pending)

  Interface (0.0.0.0) Internet: No link (pending)

  Interface (0.0.0.0) Backup1: Normal (pending)

  The interface server (0.0.0.0): Normal (pending)

  Bank interface (0.0.0.0): Normal (pending)

  Slot 1: rev hw/sw ASA-SSM-4GE-INC (State of 1.0/1.0(0)10) (top)

  Failover stateful logical Update Statistics

  Link: State Management0/0 (top)

  Stateful Obj xmit rcv rerr xerr

  General 76184539 0 767513 6

  sys cmd 767328 0 767326 1

  up time         0          0          0          0

  RPC services 0 0 0 0

  25878669 0 11 5 TCP Conn

  Conn UDP 40545710 0 40 0

  ARP 8987688 0 136 tbl 0

  Xlate_Timeout 0 0 0 0

  Tbl IPv6 ND 0 0 0 0

  VPN IKE upd 1140 0 0 0

  VPN IPSEC upd 4004 0 0 0

  VPN CTCP upd 0 0 0 0

  VPN SDI upd 0 0 0 0

  VPN DHCP upd 0 0 0 0

  SIP session 0 0 0 0

  Logical update queue information

  Heart Max Total

  Q: recv 0 7 6522961

  Xmit Q: 0 34 106685671

  output of the secondary recovery

  See the resumption of F1 #.

  Failover on

  Secondary failover unit

  Failover LAN interface: GigabitEthernet1/1 failover (maximum)

  Frequency of survey unit 1 seconds, 15 seconds holding time

  Survey frequency interface 5 seconds, 25 seconds hold time

  1 political interface

  Monitored 5 256 maximum Interfaces

  Version: Our 8.2 (2), Matt 8.2 (2)

  Last failover at: 03:36:23 ULAST December 15, 2013

  This host: secondary - failed

  Activity time: 0 (s)

  slot 0: ASA5550 hw/sw rev (status 2.0/8.2(2)) (upward (Sys)

  Backup2 (0.0.0.0) interface: no connection (pending)

  Interface (0.0.0.0) Internet: No link (pending)

  Interface (0.0.0.0) Backup1: Normal (pending)

  The interface server (0.0.0.0): Normal (pending)

  Bank interface (0.0.0.0): Normal (pending)

  Slot 1: rev hw/sw ASA-SSM-4GE-INC (State of 1.0/1.0(0)10) (top)

  Another host: primary: enabled

  Activity time: 5743217 (s)

  slot 0: ASA5550 hw/sw rev (status 2.0/8.2(2)) (upward (Sys)

  Interface Backup2 (10.2.5.1): Normal (pending)

  Internet (202.131.225.90) interface: No link (pending)

  Interface Backup1 (10.3.5.1): Normal (pending)

  The interface server (192.168.227.1): Normal (pending)

  Bank interface (10.20.1.1): Normal (pending)

  Slot 1: rev hw/sw ASA-SSM-4GE-INC (State of 1.0/1.0(0)10) (top)

  Failover stateful logical Update Statistics

  Link: State Management0/0 (top)

  Stateful Obj xmit rcv rerr xerr

  General 765518 0 35843181 874

  sys cmd 765518 0 765516 0

  up time         0          0          0          0

  RPC services 0 0 0 0

  TCP 0 0 12671303 80 Conn

  UDP 0 0 13432853 133 Conn

  ARP 0 0 8968384 661 tbl

  Xlate_Timeout 0 0 0 0

  Tbl IPv6 ND 0 0 0 0

  VPN IKE 0 0 1137 upd 0

  VPN IPSEC 0 0 3988 upd 0

  VPN CTCP upd 0 0 0 0

  VPN SDI upd 0 0 0 0

  VPN DHCP upd 0 0 0 0

  SIP session 0 0 0 0

  Logical update queue information

  Heart Max Total

  Q: recv 0 9 72011189

  Xmit Q: 0 1 765518

  You have a couple no link on your high school as well as a message no link on your primary.

  Backup2 (0.0.0.0) interface: no connection (pending)

  Interface (0.0.0.0) Internet: No link (pending)

  I recommend that you check these cables.  Don't forget that if you changed the default configuration, a failure of the single, or problems of connectivity even interface between an interface on the two ASAs fail.

  If this does not help, try entering the command interface of the monitor for the interfaces.

  --
  Please do not forget to rate and choose a good answer

• Help about LAN-based failover active / standby on pix 7.0

  Hello

  I wonder why my status active / standby faiover having to wait. And when I do sh failover state he failed on Hello not hear talk of companion to the standby state (see attachment)

  Failover on

  Status of cable: n/a - active LAN failover

  Unit of primary failover

  Failover LAN Interface: failover GigabitEthernet1 (top)

  Frequency of survey unit 1 seconds, 3 seconds hold time

  Interface frequency of survey 15 seconds

  1 political interface

  Watched 3 Interfaces maximum 250

  failover replication http

  Last failover to: 02:39:25 MYT on April 15, 2006

  This host: primary: enabled

  Activity time: 184985 (s)

  Interface inside (10.103.1.15): Normal (pending)

  Interface to the outside (210.187.51.2): Normal (pending)

  DMZ (210.187.51.81) of the interface: Normal (pending)

  Another host: secondary - ready Standby

  Activity time: 0 (s)

  Interface (0.0.0.0) inside: Normal (pending)

  Interface (0.0.0.0) outdoors: Normal (pending)

  Interface (0.0.0.0) dmz: Normal (pending)

  Failover stateful logical Update Statistics

  Link: failover GigabitEthernet1 (top)

  Stateful Obj xmit rcv rerr xerr

  101718 General 0 419 0

  sys cmd 419 0 419 0

  time 0 0 0 0

  RPC services 0 0 0 0

  Conn 74719 TCP 0 0 0

  Conn 21655 UDP 0 0 0

  ARP tbl 4928 0 0 0

  Xlate_Timeout 0 0 0 0

  VPN IKE upd 0 0 0 0

  VPN IPSEC upd 0 0 0 0

  VPN CTCP upd 0 0 0 0

  VPN SDI upd 0 0 0 0

  VPN DHCP upd 0 0 0 0

  Logical update queue information

  Heart Max Total

  Q: recv 0 2 419

  Xmit Q: 0 2 104936

  Is there something wrong with my setup?

  I use active LAN failover / standby.

  I am attached to my firewall configuration, failover, failover state sh sh and sh story of failover.

  looking at your configs... IP addresses for the rescue unit are missing... It should read something Central this:

  interface Ethernet0

  nameif outside

  IP 209.165.201.1 255.255.255.224 watch 209.165.201.2

• Update software remotely active / standby ASA 5520

  Hello

  We have a pair of 5510 s and a pair of 5520 s, each active mode / standby.  I would like to upgrade the ASDM and ASA software on these, but can't find any documentation that advise on how this can be done without physical access to devices.  There I am on the site, but we will deploy these all throughout our network and I would like to be able to perform this type of maintenance without having to travel to each site.

  We use CSM and ASDM to manage these most of the time, but are certainly capable of configuration via the CLI.

  The question may be my understanding lack the foundations of the ASA, but I really don't understand how the software can be copied to the ASAs individual of the pair so that they can be reloaded and updated continuously.  My lack of understanding also makes a difficult word question, so please forgive me that.  With a remote SSH connection to the pair, I only copy the correct software to the ASA Active?  Or y at - it a way to get the software on each disk individually in the only SSH connection?  I'm not sure how to handle the ASA ensures no comfort in it... If I can get to remote software at each ASA (copy on different disks? i.e. disk0: and disk1:?), while I will also meet a problem to update startup for each statement individually, but to solve that I guess I could just remove the old software, but cela seems bad practice before confirming the new software is ok.

  If there is an easier way to deploy the new code via ASDM or CSM, I am certainly open to that.

  Any advice or resources that anyone could offer would be extremely useful and appreciated.

  Thank you

  Justin

  Justin,

  This is exactly why. If you are using version prior to version 8.4.1, routing table information is not replicated between the devices.

  Information that is not transmitted to the rescue unit when the rollover is enabled includes these:

  • The HTTP connection table (except if the HTTP replication is enabled)

  • The user authentication (uauth) table

  • The routing tables

  • Status information for the security service modules

  http://Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml

  If your gateway of default route is learned via EIRGP and you are trying to access from the internet, you won't be able to get to the secondary unit.

  Workaround solution, put the default gateway static with a metric higher while it appears on the running configuration and sent to the secondary unit.

  Of the questions let me know.

  Mike

• How is used to monitor two ASA (active/stby) with modules IPS Cisco MARCH?

  Hello

  The two ASA with IPS modules are in Active mode / standby. When I try to add both the two IP (active / standby) in MARCH, the MARCH will complain of duplicate names.

  How set up in MARCH to monitor the ASA with IPS with topology standby active?

  Thank you!

  Hello

  The fundamental problem with this scenario is that you have modules able non-basculement in a tipping chassis - think of the pair of failover ASA as a device and modules IPS as two completely separate devices.

  Then, as we have already mentioned, add only the ASA elementary school. (High school will never be passing traffic in standby mode so it is not really necessary in MARCH) Then, with the first IPS module you can add it as a module of ASA or as a standalone device (MARCH doesn't care). With the second module IPS, the only option is to add it as a separate unit anyway.

  In a failover scenario of the SAA swap IP but SPI considering you'll ever messages from ASA active you will get messages from the intellectual property of these two IPS depending on whether you are in the ASA active at the time.

  Remember that you must manually reproduce all IPS configuration whenever you make a change.

  HTH

  Andrew.

• ASA 5500 SSL VPN Failover license

  Hello

  I have a partner who request assistance with SSL VPN licenses on the ASA 5500 firewall sharing:

  His question is:

  Both SSL, provided with the firewall of the SAA, licenses can be shared across a couple active / standby?  I would therefore have a total of (4) licenses of SSL VPN to use?

  This would also be true for two security contexts that are included with the firewall?

  For example, I buy two base ASA 5520 firewall, running active / standby, that each machine is supplied with SSL VPN licenses (2) and (2) licensing of security contexts? In version 8.3, the licenses are cumulative by failover pairs, so I should a total SSL VPN (4) and (4) security contexts?

  Here is my response to his request:

  Based on this link (http://www.cisco.com/en/US/partner/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1449664)

  It was mentioned that:

  "You can have one active license type, either the AnyConnect Essentials license or the AnyConnect Premium license. By default, the Adaptive security apparatus includes an AnyConnect Premium license for 2 sessions. If you install the AnyConnect Essentials license, it is used by default. See not anyconnect-essentials control or in ASDM Configuration > remote access VPN > network (Client) access > advanced > component AnyConnect Essentials to activate the Premium license instead. »

  It will be able to share the included license on the ASA 5500 4. It will be able to share these licenses, but I'm not sure the security context. My answer would be, it can use only 2 context Security licenses since only the VPN licenses are shared on the version 8.3 and other licenses not characteristic. My understanding is correct? or there are other explanations on my customer survey?

  Thanks in advance!

  Ice Flancia

  Cisco partner Helpline Tier 2 team

  Only from ASA 8.3 version and following, the license can be combined on a failover pair active / standby.

  2 SSL included license on SAA in failover pair is combined as 4 license SSL.

  2 license of background on ASA in failover pair is combined as license frame 4.

  Here's the URL on ASA combined license failover:

  http://www.Cisco.com/en/us/partner/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1450094

  Hope that helps.

• Safe way to restart the pair active / standby

  Hello

  I need to reboot my ASA5520. We have a pair of active / standby and I want to make sure they come in playing well and not in a fierce struggle.

  Any advice on how to reload these machines and optimize operating times?

  Thank you

  Pedro

  Pedro

  If you are not bothered in regards to he who becomes primary then simply pick one, reboot, wait until it has developed and then reload it.

  As long as you have properly configured failover, there should be minimal downtime, just the time it takes to switch when you reload.

  If you want to stay as the main primary school, then you need to recharge it first, let it come as standby, then reload the other and the former primary school will now become primary.

  Note that recharge the standby is firstly the best approach simply because you then have only a failover IE. When Eve comes backup and resumes, it's a standby feature then you recharge the primary here will be a failover.

  Jon

• Active / standby ASR9000v ICL

  Hello world

  After reviewing the documentation for the 9000v, I wonder if it is possible to configure the following scenario without using nV Edge. I have a pair of ASR9912 that are configured as standalone units. We received 3 ASR9000v which we configured in a scenario of the active / standby as part of a requirement of the customer.

  There is a pattern in this link: https://supportforums.cisco.com/document/9868421/asr9000xr-using-satelli... that shows the scenario, but it seems like a VSS deployment. In the same document, section 13 describes a Dual-host configuration. I wonder if that's what I'm looking for. Interfaces GigE on the system of 'sleep' will be in a break state? I'd be worried about some conflicts.

  I'm not the second 9912 upward and going until mid-January because of the power and the grid space, so I can't test until then.

  Has anyone successfully deployed this scenario without using nV Edge?

  Thank you.

  -Dominique

  DOM,

  We prefer that you evaluate advanced bifocals, which is a new feature. You will not need to use NV EDGE and we are actually calling customers of this technology to something more standards based. Take a look at the following:

  http://www.Cisco.com/c/en/us/TD/docs/routers/asr9000/software/asr9k_r5-3...

  Concerning

  Eddie.

• licenses for a cisco ASA active/passive pair AnyConnect SSL

  Hi all. I buy 2 5512 x ASAs is configured like a pair of active/passive as a VPN device. I need to purchase licenses for both devices anyconnect? Thank you

  Licenses AnyConnect Essentials (or premium) are combined on a cluster failover ASA. Reference

  So, buy once only the quantity and type of licenses you need based on your end users - not based on the number of ASAs - and they will be available at the ASA Active whether primary or secondary unit.