Adding failover ASA back after config changes on "primary" ASA?

I had a working active/passive pair of ASA5510's, and then I had to do a rush firmware upgrade, but didn't have time to do it on the secondary at the same time. Now I have made config changes and upgraded the secondary firmware to be the same, and wish to know if I plug it back in if it will think the secondary has the "correct" config or if it will know that the primary is newer. I disconnected the failover cable because it was complaining about version mismatches constantly.
Is it safe to add the secondary back in or is it possible it will be declared newer and overwrite the config?

Hi,
There should be no problem adding another ASA back to the network.
Here is what I just did (and what happened) on a rather big customer
A power fault broke Secondary ASA and it never booted up
A replacement device was aquired
The replacement device was
Updated to matching hardware setup (mainly memory)
Updated to same software (OS and ASDM)
Configured with its physical interface up with "no shutdown"
Configured with ONLY "failover" configurations (exact configuration ofcourse depends on your setup)
It was attached to the rack and powered up.
After boot every interface BUT "failover" was attached to the network (Dont necesarily have to do it in this order) and I checked that every single one was up.
After everything above was done I connected the failover interface and watched as the devices "noticed" eachother and the Active firewall copied its configuration to the new Secondary unit.
This was done in a factory environment and all went fine.
There should be no problems doing this though I personally still prefer doing the replacement by attaching a "blank" ASA with only Failover configurations.
EDIT: Beeing that I am always paranoid when doing anything like this, I had ofcourse saved the configurations to flash on a separate file for worst case scenario and was ready to boot the original primary unit incase it took in something it wasnt supposed to.
EDIT 2: In the case where you think the Secondary unit doesnt have the exact configuration of the Primary unit, you can issue the command write standby on the Primary unit to save/copy the COMPLETE configuration of the Primary unit to the Secondary. Think the "write mem" on the Primary unit only updates some changes you have made to the Secondary unit
- Jouni

Similar Messages

%ONLINE-SP-6-REGN_TIMER: multiple line cards down after config change

Hi,
I was wondering if someone could help.
I recently changed the entire configuration on two 6509 switches, and the fibre modules on slot 7 and 8 have gone down on BOTH switches. It would be easy to say that its a hardware fault but I cannot understand how module 7 and 8 can go down on both switches. Initially I thought it maybe due to IOS bug 22-33.SXI2a.bin" so I upgraded it to s72033-advipservicesk9_wan-mz.122-18.SXF12a.bin but it still down.
These are the actions I have carrried out to try resolve the issue:
- Reverted back to orginal configs but no luck
- Tried to use "power enable" command but the status light on both modules seems to turn red and then go off again.
- I have also tried to put one of the fibre modules into a different slot but no joy
- Upgraded the IOS from 22-33.SXI2a. to 122-18.SXF12a
I am running out of ideas.. can anyone help ? I am sure that hardware fault cannot occur on BOTH modules 7 & 8 on BOTH switches after config change.
The error in the log shows that modules "failed to bring online because of registration timer event". I understand this means that it is unable to download the image within the allocated time.. maybe I could manually copy the image onto the line card if that is possible ?? any ideas ?
Daughterboard         WS-SUP720          SAL135063V2 4.0    Ok
7 Centralized Forwarding Card WS-F6700-CFC       SAL1419HKJK 4.1    PwrDown
8 Centralized Forwarding Card WS-F6700-CFC       SAL1419HAG0 4.1    PwrDown
Mod                                                      Hw    Fw           Sw           Status
7 5475.d016.075c to 5475.d016.075f   3.1   Unknown      Unknown      PwrDown
8 5475.d0bb.7404 to 5475.d0bb.7407   3.1   Unknown      Unknown      PwrDown
System image file is "disk0:s72033-advipservicesk9_wan-mz.122-18.SXF12a.bin"
BOOT variable = disk0:s72033-advipservicesk9_wan-mz.122-18.SXF12a.bin,12;sup-bootdisk,1;
CONFIG_FILE variable =
BOOTLDR variable =
Configuration register is 0x2102
Standby is not present.
May 28 17:25:10.352: %C6KPWR-SP-4-DISABLED: power to module in slot 7 set off (Module Failed SCP dnld)
May 28 17:25:10.452: %ONLINE-SP-6-REGN_TIMER: Module 8, Proc. 0. Failed to bring online because of registration timer event
sm(cygnus_oir_bay slot8), running yes, state wait_til_online
Last transition recorded: (disabled)-> disabled (disabled)-> disabled2 (restart)-> wait_til_disabled (timer)-> may_be_occupied (timer)-> occupied (known)-> can_power_on (yes_power)-> powered_on (real_power_on)-> check_power_on (timer)-> check_power_on (power_on_ok)-> wait_til_online
May 28 17:25:10.452: %C6KPWR-SP-4-DISABLED: power to module in slot 8 set off (Module Failed SCP dnld)
May 29 11:41:16.601: %SYS-5-CONFIG_I: Configured from console by console

Would anyone know if the line cards are maybe failing due to Embedded Event Manager configuration ? The person who configured this lab has left the company so I am not sure what the EEM configurations actually mean.
The reason i am suspecting the EEM configuration is because the error in the log seems to suggest the module failed due to registration timer event.
May 30 14:47:00.366: %ONLINE-SP-6-REGN_TIMER: Module 8, Proc. 0. Failed to bring online because of registration timer event
Just trying to check all the possibilities as I have tried everything else,
event manager directory user policy "disk0:/fcp_eem"
event manager directory user repository tftp://10.11.x.x/xxx/
event manager scheduler script thread class default number 10
no event manager policy Mandatory.go_switchbus.tcl type system
event manager policy rp_test.tcl type user
event manager detector rpc ssh acl 60 event manager directory user policy "disk0:/fcp_eem"
event manager directory user repository tftp://10.11.216.145/FCPD/
event manager scheduler script thread class default number 10
no event manager policy Mandatory.go_switchbus.tcl type system
event manager policy rp_test.tcl type user
event manager detector rpc ssh acl 60

%OSPF-4-FLOOD_WAR messages after config change

I recently changed some configs on two L3 switches running OSPF. After this change I'm now getting the below log message about ever 2 minutes or so on one of the switches (172.22.0.53):
%OSPF-4-FLOOD_WAR: Process 1 re-originates LSA ID 172.18.24.3 type-2 adv-rtr 172.22.0.53 in area 0
The two switches are using loopbacks 172.22.0.53 and 172.22.0.89, and are connected via a radio link. Previously both switches were using Layer 3 vlan interfaces with their OSPF configs applied to those vlan interfaces, then the physical interfaces were added in this VLAN as a L2 interface. The radio AP's were also within this vlan and not participating in OSPF. Under this setup I was not getting these Flood War messages, but was having a spanning-tree issue which is why I removed the L3 vlan interfaces.
I changed the physical ports to routed ports and copied the L3 vlan interfaces over and removed the L3 vlans. This is working, but now I'm getting these OSPF Flood war messages. I didn't change any router ID's, and the IP's set on the L3 vlans were moved to the L3 routed ports so I'm not sure where the duplicate is coming from. I've attached the configs of both switches.
Any ideas?

Hi
from url:-
http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/9237-9.html
Q. What does the error message %OSPF-4-FLOOD_WAR: Process process-id re-originates LSA ID ip address type-2 adv-rtr ip address in area area id means?
A. The error message is due to the some router that is flushing the network LSA because the network LSA received by the router whose LSA ID conflicts with the IP address of one of the router's interfaces and flushes the LSA out of the network. For OSPF to function correctly the IP addresses of transit networks must be unique. If it is not unique the conflicting routers reports this error message. In the error message the router with the OSPF router ID reported as adv-rtr reports this message.
Also on your 53 config
You have a paasive int on vlan 153 but that SVI does not exist , 133 does though
Regards
Alex

WCL Tracking Scenario (Search List) not updated after config change

Dear Users,
Initially I assigned 3 User profiles and Web Interface Transaction to my user ID under the transaction : Event Management -> Event Messages, Status Queries and Web Interface -> Web Interface -> Assign User profile and Web Interface transactions to Users
When I login to WCL using my user ID, I was able to see these three tracking scenarios in my Search page drop down.
Now I go back to config and add new user profiles and web interface transactions to the same user id.
But when I login to WCL, the search page still remains the same( the three old tracking scenarios are there, new ones not reflected) !!!
Can this be any setting in the internet explorer which is not allowing to refresh? I have tried deleting cookies etc. But no change!!
Please HELP with your expert advise.
Thanks in advance.
Regards,
Rimjhim

Can you share the solution.

Cat6509 hangs after config change

I have two 6509 Sup720 Boxes running IOS 12.2.(18)SXD4. If I do a show run command after making any config change my telnet session will hang. If I open another session I can run other show commands but, If I do show run it will hang again. The boxes will continue to work fine, just the console hangs. After about 10 - 15 min it will reset and it's ok???????

Not sure what that would be , we have the same setup with SXD4 running on probably 20 6509's and haven't had a problem . Are you talking console or vty session hanging ???

Secondary ACS 5.1 fails to Deregister, after IP change on Primary

IP address of Primary had to be changed, to respond to a hardware failure of TACACS server with IP in many device configs.
Now the Secondary fails to respond to repeated "Deregister from Primary" requests, even after reload -
   apparently because it cannot reach the Primary at its old IP address.
Requesting Deregister in GUI generates pop-up that says, "This operation will deregister this ACS Instance from the Primary Instance.
     Management applications on this ACS instance will be restarted and you will be required to login again. After performing this operation
     please wait five minutes for this restart to complete.
     Do you wish to contine?"      [ OK ]
But, checking back after 10 minutes -- or even the next day -- finds the Secondary's status unchanged.
Also tried Local Mode, Deregister from Primary; this also fails.
Does anyone have HOWTO URL on a total rebuild of ACS application?
Both ACS are CACS-1121-K9   running 5.1.0.44.4.
Thanks in advance for any help...
*** UPDATE: ***
Recommended command, "application reset-config acs",    was _exactly_ what was needed.
jrabinow -   many thanks!    :-)
    also, thank you for mentioning that the license would be required, so that I could locate it in advance and have it ready.
      Since there were no local certs on the server, we did not need to re-install those.

Since this is a secondary it should not have too much in terms of specific configuration
Therefore one possibility is to reset the configuration so it once again becomes just a standalone node and then regsiter back to the deployment as is done for any new node and as you previosuly registered it
reset configuration can be done using the following command at the CLI:
application reset-config acs
Note that after you reset the configuration you will need to reinstall the license so make sure you have this to hand
Also if you has installed a server certificate for the secondary server you would need that too

Nexus 5548 reboots after config change

Hi all,
A customer configured his nexus 5000 with the basic configuration. This incudes also ssh (generate a certificate)
After that the switch reboots all the time.
I would like to test it tomorrow without the startup config. Is it possible to reboot the n5k without the startup config ? And is there also a ROM mode ? I don't found any docs on Cisco...
Thanks
Udo
Sent from Cisco Technical Support iPad App

Are you using the "ip arp synchronize", "peer-gateway" and "peer-switch" features? Those all help mitigate aspects of traffic flow that could be related to what you're seeing.

Calendar events keep changing back after I change them

On my iMac 3.2 GHz Intel Core i5, 8 GB 1600 MHz, Yosemite loaded, calendar 8.0 events will not change. I can add events but not change them. I've tried refresh. I've followed all the troubleshooting re: to iCloud.

Apple's Mail application can use either IMAP or POP. In fact Gmail can be set either way.

Best way to change config then change it back after a while.

I spent some time today trying a couple approaches to this, but they all seemed a little klunky.
I'm looking for the best way to change the BGP prefixes which are advertised out to an ISP, based on some check. I want to set a timeout so the router won't attempt to send the route again for say 30 minutes after it is triggered, but then will start advertising it again, and monitor to see if the trigger condition returns. If the trigger condition returns then again withdrawl the route for 30 minutes and so on.
I'm using a prefix-list already to limit outbound route advertisments, so it seems simplest to just make a config change to remove one line in the prefix-list, then a few minutes later put it back.
I tried just using the "cli command wait", but if I set the wait period too long, the applet seemed to die, and never ran the later cli commands to put the prefix-list line back. There is also a exit-time clause for the event, but I couldn't figure out how to put the line back after the exit-time expired. Lastly I tried doing an event with a watchdog timer, but also couldn't get that to work either. Before I spend too much time working on differant options, I wanted to see if anyone had any recommendations.
I've done some TCL scripting on Cisco routers, but that seemed to be overkill for this, and I wanted to keep the config easy to manage for peers who might not be as proficient in TCL scripting.
This is intended for ASR-1002X routers if it matters.
Any suggestions would be much appreciated.
Thanks
Derek

Thanks for all your help Joe.
Ok, so here is my current script, which seems to be working pretty well (changing to entry-type "value" fixed the variability in detection times). For testing in the script below, I'm using a 30 second timeout for when the line gets put back, and a 60 second timeout for when monitoring should resume after the event is triggered. The script checks the value of the OID every 5 seconds.
The only other thing I would like to do with it that I can't figure out, is how to use an environment variable for the exit-time. Ideally, I would just add a value, like 10 seconds, to the ATimeout variable. However I can't figure out the syntax to just use a var for the exit-time. Anyone know the secret (or if it is possible?)
event manager environment ATimeout 30
event manager environment q "
no event manager applet DDOS_RESPONSE01
event manager applet DDOS_RESPONSE01
event snmp oid 1.3.6.1.4.1.9.9.166.1.17.1.1.21.80.65538 get-type exact entry-op gt entry-val "0" entry-type value exit-time 60 poll-interval 5
trigger
action 001 cli command "enable"
action 002 cli command "config term"
action 003 cli command "no ip prefix-list PUBLIC_NETWORKS seq 140 permit 10.4.1.0/24 le 32"
action 004 syslog msg "DDoS Attack Detected. Removing Web Srvr Subnet from PUBLIC_NETWORKS for ($ATimeout) seconds."
action 005 cli command "event manager applet RESTORE_PREFIX"
action 006 cli command "event timer countdown time $ATimeout "
action 007 cli command "action 101 cli command $q enable $q"
action 008 cli command "action 102 cli command $q config term $q"
action 009 cli command "action 103 cli command $q no event manager applet RESTORE_PREFIX $q"
action 010 cli command "action 104 cli command $q ip prefix-list PUBLIC_NETWORKS seq 140 permit 10.4.1.0/24 le 32$q"
action 011 cli command "action 105 syslog msg $q DDoS Attack Timeout ($ATimeout) reached. Re-adding Web Srvr Subnet to PUBLIC_NETWORKS. $q "
action 012 cli command "action 106 cli command $q no event manager applet RESTORE_PREFIX $q"
exit
event manager environment ATimeout 30
event manager environment q "
event manager applet DDOS_RESPONSE01
event snmp oid 1.3.6.1.4.1.9.9.166.1.17.1.1.21.80.65538 get-type exact entry-op gt entry-val "0" entry-type value exit-time 60 poll-interval 5
trigger
action 001 cli command "enable"
action 002 cli command "config term"
action 003 cli command "no ip prefix-list PUBLIC_NETWORKS seq 140 permit 10.4.1.0/24 le 32"
action 004 syslog msg "DDoS Attack Detected. Removing Web Srvr Subnet from PUBLIC_NETWORKS for ($ATimeout) seconds."
action 005 cli command "event manager applet RESTORE_PREFIX"
action 006 cli command "event timer countdown time $ATimeout "
action 007 cli command "action 101 cli command $q enable $q"
action 008 cli command "action 102 cli command $q config term $q"
action 009 cli command "action 103 cli command $q no event manager applet RESTORE_PREFIX $q"
action 010 cli command "action 104 cli command $q ip prefix-list PUBLIC_NETWORKS seq 140 permit 10.4.1.0/24 le 32$q"
action 011 cli command "action 105 syslog msg $q DDoS Attack Timeout ($ATimeout) reached. Re-adding Web Srvr Subnet to PUBLIC_NETWORKS. $q "
action 012 cli command "action 106 cli command $q no event manager applet RESTORE_PREFIX $q"
exit

Active/Standby Failover Config change

Hi everyone,
This weekend we are doing some change on ASA in Active/Standby mode.
We will power off standby ASA.
Do some changes on Active ASA save the changes and reboot it.
Power up the Active ASA and will test the connectivity if it is working or not .
In case Active ASA is not working as expected after the change i will power it off.
Power up Standby ASA then it will become active as expected.
Now if i Power up other ASA where changes were made will it synchnorize to old config from Standby ASA or not?
Last week we did some changes on Active ASA and it did not work as expected so we have to undo our change.
Need to make sure our backup plan is working?
Regards
Mahesh

In your fall back scenario you would have to tell what was the secondary ASA that it is now the primary
change
failover lan unit secondary
to
failover lan unit primary
and vice-versa on the now primary ASA.
change
failover lan unit primary
to
failover lan unit secondary
Hope it helps

SIP stops when upgrading from ASA from 8.4.1 to 8.4(2)8 w/ out config change? Why?

I have to be missiong something small in my config.
If I upgrade my ASA 5510 which I am routing and NATing off of, from 8.4.1 to 8.4.2.8, SIP stops. All phones go dead.
If I roll bck to 8.4.1, SIP comes up.,... Go bck to 8.4(2)8 nd SIP goes down.....
This is without mking any config changes.
I have looked at it so long, I must be overlooking something simple, simple, simple...

Have spent sIx hours in past 24 w/ Cisco TAC and they have a tin of caps as have I but can't figure out why there is a denial of SIP from inside outside and outside inside to/from sip providers three IP addresses. Have created new access lists, new access groups to allow all 3 ip's in & out, increased timeout, bypassed IPS, have both sip UDP & tcp allowed in/out, specified inspection to approve any any for all sip protocols in/out to/from Lync & mediation and nada.
To answer another question, yes I'm certain config doesn't change... I reloaded tge same running config from a bkup just to make sure.....
What I see in the logs coming in/out is the call does make it all the way through the SSM to the ASA..
What happens there is the head scratcher...
SiP even though allowed and even though I've specified it to push through inspection On ASA side is denied based on inspection rule...
I also tried using another one of my (unused) public IPs for only SIP thinking that maulybe there was a core conflict with multiple services NATd to the same public IP but that also did nothing.
On topology I only have a single location so I'm using my 5510 to route as well...
Have 1 IIS web server l, SQL, (ports clised except to obe vendor and am allowing via access list by their IP and ipsec,) Exchange, Lync, Ironport, Endpoint and everything else is 80/80...
Everything is on Server 08r2 w/ exception of web server and two boxes ( one stand-alone & one VM on hyper-v) I am running Server8 for Microsoft TAP engineering / validation airlift. Neither of those are attached to UC/UM at all...
I'm using dynect from dyndns for outside network web services and just piggybacking on time Warner metro e for internal (no physical DNS server)
When I look at caps everything is identical in the tcp and UDP trace even on sip except for the denial...
Which caps/logs would 'y'all like to see and I'll post em when I get home....
Is there a link to bug notes Jullio? Is it sip specific? Any possibility of it being just a name/cosmetic big I can force a work around to?
I recall when Asa first was released I had to specify port 25 allow instead of being able to simply say allow smtp .. That took 2 weeks but it allowed for a work around so whatever I can do/try I'm willing!! Someone may wanna tell TAC if it's a bug because after 6 hours yesterday they are saying there's not a bug... :)
Thanks all!!!!

SNMPv3 config changing after reboot

Whenever one of my C2960's reboot, our Solarwinds monitoring stops working. I found that this is due to one line of SNMPv3 config changing by itself. This used to be in the config:
     snmp-server group XXX v3 priv access permit-snmp
(permit-snmp being the access-list defining ip addresses allowed to query) After the reboot, snmpv3 stops working and this line shows up in the config instead of the one above:
     snmp-server group XXX v3 priv notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF7F
Is this a bug? (I did check the bug database, without success.) I have upgraded the IOS to 12.2(53) SE2 without any success. The switch is a C2960-24TC-L.

I had the same problem and believe the issue is that you probably have a trap server configured and are using the same snmp-server group for the trap server and your queries. I created another group for SNMPv3 queries and the configuration no longer seems to get overwritten. Here's what I did.
Go into config mode and create a group just for the trap server - let's call it TRAPS. I used priv and it looks like that's what you use. Don't worry about defining any MIB views as this group will automatically populate the notifyview once the trap servers below are added to the config. (...and will remove the readview and writeview entries after reboot - that's why a second group is needed). Remove your old trap server entries and set up the new trap server using the new group called TRAPS.
snmp-server group TRAPS v3 priv
snmp-server host version 3 priv TRAPS
Now create another group for queries only - (let's call it QUERIES but you could just use your current group XXX since it's already set up) - I like the v1default MIB view for both reads and writes but you can limit the MIBs with the snmp-server view command. I am using md5 and des56 here - your case may be different - and set up the user (or keep the one you already have configured)
snmp-server group QUERIES v3 priv read v1default write v1default access
snmp-server user QUERIES v3 auth md5 priv des56
Exit and check the config.
The group TRAPS should have the notifyview set. The group QUERIES should have the readview and writeview set to v1default (or whatever view you chose to enter here). The two SNMPv3 groups should look like this:
#sh snmp group
groupname: TRAPS                            security model:v3 priv
readview :           writeview:
notifyview: *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.F
row status: active
groupname: QUERIES                          security model:v3 priv
readview : v1default                        writeview: v1default
notifyview:
row status: active      access-list: 4
The old trap server entry using the old group XXX should have been removed already. Verify that the user: entry says TRAPS
#sh snmp host
Notification host: xxx.xxx.xxx.xxx      udp-port: 162   type: trap
user: TRAPS     security model: v3 priv
Finally make sure the user is in the correct group (QUERIES):
#sh snmp user
User name:
Engine ID: xxxxxxxxxxxxxxxxxxxxxxxxxx
storage-type: nonvolatile        active
Authentication Protocol: MD5
Privacy Protocol: DES
Group-name: QUERIES
If all is well - write the config. You should now be able to perform a coldstart without losing your SNMPv3 config.
Please, let me know if this worked for you.

How do I get my web pages back to original size? My fonts are all too large and keep reverting after I change them back!

How do I get my web pages back to original size? My fonts are all too large and keep reverting after I change them back!

That has not worked. I do it and still it reverts. Isn't there a way to tell Firefox to just go back to default settings?

I formatted my ext hard drive and changed it to mac os x extended(journaled). then i put in all my data back. after a while, i insert the hard drive but my macbook cannot read it. plz help

i formatted my ext hard drive and changed it to mac os x extended(journaled). then i put in all my data back. after a while, i insert the hard drive but my macbook cannot read it. plz help

SanandaDutta
tried on a different mac. The same problem exists.
If that is the case, its extremely unlikely you have a bad USB cable on the seagate, rather as I mentioned earlier a bad SATA bridge card.
If the Seagate 1TB USB external wont open on either Mac and youve verified same (try a diff. USB cable if you have one however this is nearly never the case),....then to get the data off that HD (unless it is dead which is also extremely unlikely),......then you would need to extract the HD from its case and insert same into either a HD dock or USB HD enclosure.
8 out of 10 seemingly dead inopperable 1-3+ year old external HD are perfectly fine, rather the cheap 50 cent SATA bridge card fries and dies (alas)
reply back if you need help in extracting same.

I downloaded acdsee camera flash (us$0.99) in Hong Kong's app store, but i cannot find it in the app store after i changed to another iphone. it seems that the app is no longer available in HK, how can I get back the app?

i downloaded acdsee camera flash (us$0.99) in Hong Kong's app store, but i cannot find it in the app store after i changed to another iphone. it seems that the app is no longer available in HK, how can I get back the app?

First make sure you are searching the name correctly.
If the app is no longer in the App Store it is no longer available for download. This happens when Apple has found the app violates the agreement with the developer or when the developer no longer wants the app listed in the App Store.
If the app is truly no longer in the App Store your only option is to copy it from iTunes on the computer you normall sync with.

Adding failover ASA back after config changes on "primary" ASA?

Similar Messages

Maybe you are looking for