ASA actice/standby with subinterface

I try to configure active/standby with ASA5520 Version 8.0(2). In configuration guide I read:
The if_name argument assigns a name to the interface specified by the phy_if argument. The phy_if argument can be the physical port name, such as Ethernet1, or a previously created subinterface, such as Ethernet0/2.3.
But when I try to do this, I get an error message:
ERROR: Can not configure failover interface on a shared physical interface
What is going wrong?

If I recall correctly from my ASA setup (about 14 months ago so I could be mistaken), we tried setting our failover interface on a sub-interface and it didnt work. I then took a look at some Cisco documentation and they suggest that you use a dedicated interface for Failover (that is what we did). We have 1 interface for failover, 1 for DMZ, 1 for Outside and 1 for Inside and everything is functioning correctly. I am trying to find the link I used from Cisco when researching this, but I am fairly sure that was what I came up with.
Hope this helps
Chris

Similar Messages

PortChannel in Cisco ASA with subinterface vlan

Dear Cisco Expert,
I have problem with portchannel in cisco ASA with subinterface, My asa create port channel two link with switch :
my asa configuration (PO3 == int gi0/1 & int gi0/0 ASA) :
interface Port-channel3
no nameif
no security-level
no ip address
interface Port-channel3.20
vlan 20
nameif XXXX
security-level 50
ip address 172.27.3.1 255.255.255.224
my switch configuration (PO3 == int gi0/19 & int gi0/20 switch) :
interface Port-channel3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20,30,40,50
switchport mode trunk
end
I also tried create int vlan 20 in switch,
interface Vlan20
ip address 172.27.3.2 255.255.255.224
end
but it doesn't work
the etherchannel status is still in waiting :
show etherchannel sum :
3 Po3(SD) LACP Gi0/19(w) Gi0/20(w)
Do you have any clue ?
Thank u guys, ...
Btw, if i create ASA port chanel withoout subinterface it's work.
Best Regards
Rizal Ferdiyan

You ASA cofniguration should look like this. You havnt posted the full config so no comment on that
interface GigabitEthernet0/0
channel-group 10 mode active
speed 1000
duplex full
no nameif
no security-level
no ip address
interface GigabitEthernet0/1
channel-group 10 mode active
speed 1000
duplex full
no nameif
no security-level
no ip address
interface Port-channel3
speed 1000
duplex full
no nameif
no security-level
no ip address
interface Port-channel3.20
vlan 20
nameif XXXX
security-level 50
ip address 172.27.3.1 255.255.255.224
Thanks
Ajay

Cisco ASA Active standby failover problem

We have configured ASA Active standby failover with ASA5505 . When primary unit power off, secondary unit became active. when primary unit power on, then primary unit is becoming active again. i think for active standby setup there is no preemption. The real issue is when primary ASA became active after power on all the external connectivity getting down. Please see the below config,
ASA01# show run
ASA01# show running-config
: Saved
ASA Version 8.2(5)
hostname ASA01
enable password PVSASRJovmamnVkD encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.1.1 MPLS_Router description MPLS_Router
name 192.168.2.1 SCADA_Router description SCADA_Router
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
switchport access vlan 2
interface Ethernet0/3
interface Ethernet0/4
switchport access vlan 3
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 192.168.3.8 255.255.255.0 standby 192.168.3.9
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.8 255.255.255.0 standby 192.168.1.9
interface Vlan3
description LAN Failover Interface
ftp mode passive
clock timezone AST 3
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any host MPLS_Router
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit ip any any
access-list outside_access_in extended permit ip any 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
failover
failover lan unit primary
failover lan interface FAILOVER Vlan3
failover key *****
failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route-map Route_Out permit 1
match ip address inside_access_in outside_access_in
match interface inside
route outside 0.0.0.0 0.0.0.0 MPLS_Router 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
http authentication-certificate inside
http authentication-certificate outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.2.0 255.255.255.0 inside
telnet 192.168.1.0 255.255.255.0 outside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password eY/fQXw7Ure8Qrz7 encrypted
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:1a8e46a787aa78502ffd881ab62d1c31
: end

I suggest removing the failover configuration on both units and then re-add them, and then test.
Primary
failover lan interface FAILOVER Vlan3
failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
failover lan unit primary
failover key KEY
failover
Secondary
failover lan interface FAILOVER Vlan3
failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
failover lan unit secondary
failover key KEY
failover
Please remember to select a correct answer and rate helpful posts

ASA Active/Standby mode and Hello messages

Hi Everyone,
On ASA Active/Standby mode i know thatsay inside or any other interface of active and standby ASA should connect to same switch and vlan.
When we assign say ip address to inside interface of both ASA like
ip address 192.168.x.1 255.255.255.0 standby 192.168.x.2 255.255.255.0
Need to know if these inside interface talk to each other or not?
Do they send hello messages?
Thanks
MAhesh

Hi Mahesh,
The ASA Active/Standby Failover pair uses both the dedicated Failover interface and the actual Data interfaces to monitor the "health" of the Failover pair.
The units send Failover hello messages and wait for a reply to determine if the other unit is alive or not.
By default all Physical interfaces are automatically monitored. To my understanding Logical interfaces such as Trunk interfaces are NOT monitored by default. You will have to configure monitoring for each subinterface of the Trunk that you want to be monitored.
You would use the command
monitor-interface
Check the Command Reference section for this
http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/m.html#wp2123112
I would also suggest reading the following section of the Configuration Guide
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_overview.html#wp1079010
It has information of the Unit and Interface health monitoring of the Failover pair.
If you want to debug Failover activity you could use the command
debug fover
It has multiple additional parameter after that command
Here is the Command Reference section for the debug command
http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/d1.html#wp2093011
You can even attach a computer on the switch between the ASAs and capture the packets between them an you can see the Failover messages etc from the ASAs
- Jouni

Mount STANDBY with EE software created from SE production database

We mount (by error) our STANDBY databases with Enterprise Edition EE softare.
Our production database is Standard Edition SE.
We apply the logs without problem, but we have intention the mount the STANDBY database with SE software.
-> Could be possible mount the STANDBY database without need to recreate it? Remember the origin db are created from SE software and mount the STANDBY with EE software.
Thanks you!
Any help are welcome.
Diego.

Please read Note:139642.1 on metalink.

Steps to create the standby with Hot Backup........?????

Hi All
I am planning to create the Physical standby with Hot backup ....
Can anyboby give me the link/steps which explains how to do this?
Thanks
Gagan

To copy the file from the primary, you can use RMAN, or manual hot backup copy with begin backup and end backup mode.
You can read the doc about creation of standby database :
http://download-uk.oracle.com/docs/cd/B19306_01/server.102/b14239/create_ps.htm#i70835
http://download-uk.oracle.com/docs/cd/B19306_01/server.102/b14239/scenarios.htm#i1032302
Nicolas.

Standby with oracle apps

Dear all,
11.5.10.2 with DB 10.2.0.3
We have configured Physical standby with the above. We need to apply some patches on production , the database will be automatically synchronized with the DR, but how we can handle the applciation tier in DR ? How to make it synchronized ?
Kai

Thanks all,
I found the below output in the note
Document TitleBusiness Continuity for Oracle Applications Release 11i, Database Releases 9i and 10g (Doc ID 216212.1)
Section 4: Applying an Applications Patch
Does anyone have any other input?
Kai
Edited by: KaiS on Nov 15, 2011 10:27 AM

Lumia 1520 Discharges 18% per hour in standby with...

When we first got 1520 6 weeks ago, battery performance was pretty good but now
1. Lumia 1520 Discharges 18% per hour in standby with no background tasks runinng
2. Took 1520 back to Microsoft Store and have now had 2 replacements and all behave the same
Discharge between 18 and 22% per hour - no data, no tasks running and phone not even being used

Thanks for those who replied - so the issue is now basically solved
What we did was :
1. Reset phone
2. Setup phone as a new phone and did not download any of our purchased apps from Microsoft Store
3. Voila - battery now behaves perfectly - discharge rate is 2.53% per hour - down from over 18%
4. So although - we never had any apps runnig when the battery was discharging at 18% - we surmise that some app was behaving badly
5. Now all we need to do is to find out which app was the culprit
Thanks again to forum members for their input

MPLS with subinterfaces

Is it possible to run the VRF's over subinterfaces.
I want a PE which will be connected to a L2 switch on a dotq trunk and will have two subinterfaces corresponding to 2 customers to forward the traffic out the proper sub interfaces.
The switch is a pure L2 switch and is not possible to run VRF lite on it.
The setup works perfectly when both the customers are terminated on different LAN interface.
Is there any special configuration required to make this work with subinterfaces?
Narayan

Hi Narayan,
It's not a problem.
Here is an example (PE1):
interface FastEthernet0/0
no ip address
no shutdown
interface FastEthernet0/0.1
description VRF EFS
encapsulation dot1Q 2
ip vrf forwarding EFS
ip address 144.12.16.1 255.255.255.0
no ip redirects
no ip proxy-arp
no shutdown
interface FastEthernet0/0.2
description VRF VoIP
encapsulation dot1Q 3
ip vrf forwarding VoIP
ip address 172.16.2.1 255.255.255.0
no ip redirects
no ip proxy-arp
no shutdown
Regads,
Alexander

HWIC-1GE-SFP in 2821 trouble with subinterfaces

Has any problems been reported creating subinterfaces using HWCI-1GE-SFP on 2821 running IOS 12.4.24T4? No problems performing confiugration but cannot ping the remote interface with subinterfaces and DOT1Q TAG?

Hello,
Can you past the configuration of the devices.
Kind Regards
Sent from Cisco Technical Support iPhone App

How do I use Cisco MARS to monitor two ASA (active/stby) with IPS modules?

Hi
The two ASA with IPS modules are in active/standby mode. When I try to add both the two IP (active/standby) into the MARS, the MARS will complain duplicated hostnames.
How to setup MARS to monitor ASA with IPS with active standby topology?
Thanks!

Hi,
The fundamental problem with this scenario is that you have non-failover capable modules in a failover chassis - think of the ASA failover pair as one device and the IPS modules as two completely separate devices.
Then, as already mentioned, add only the primary ASA. (The secondary will never be passing traffic in standby mode so it's not actually needed in MARS) Then, with the first IPS module you can add it as a module of the ASA or as a standalone device (MARS doesn't care). With the second IPS module the only option is to add it as a separate device anyway.
In a failover scenario the ASA's swap IP's but the IPS's don't so whereas you'll only ever get messages from the active ASA you'll get messages from both IPS IP's depending on which one happens to be in the active ASA at the time.
Don't forget that you have to manually replicate all IPS configuration every time you make a change.
HTH
Andrew.

Cisco ASA 5520 Failover with DMZ

I have a pair of Cisco ASA 5520s running as a primary/standby. Everything is working properly with the primary ASA, however when I trigger a failover, everything works except for the DMZ interface on the standby ASA. I've poured over the configs, but perhaps I have been staring at them too long because I am just not seeing anything.
Below is the output of the sh run failover, sh failover, and sh run interface commands for each unit...
PRIMARY ASA
Primary-ASA# sh run failover
failover
failover lan unit primary
failover lan interface stateful1 GigabitEthernet0/3
failover key *****
failover link stateful1 GigabitEthernet0/3
failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
Primary-ASA# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 160 maximum
Version: Ours 8.2(5), Mate 8.2(5)
Last Failover at: 20:39:23 CDT Sep 3 2013
This host: Primary - Active
Active time: 69648 (sec)
slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
     Interface outside (184.61.38.254): Normal
     Interface inside (192.168.218.252): Normal
     Interface dmz (192.168.215.254): Normal (Waiting)
     Interface management (192.168.1.1): Normal (Not-Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
     IPS, 6.0(3)E1, Up
Other host: Secondary - Standby Ready
Active time: 2119 (sec)
slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
Interface outside (184.61.38.253): Normal
Interface inside (192.168.218.253): Normal
Interface dmz (192.168.215.252): Normal (Waiting)
Interface management (192.168.1.2): Normal (Not-Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
IPS, 6.0(3)E1, Up
Primary-ASA# sh run interface
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
ospf cost 10
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
ospf cost 10
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
ospf cost 10
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
ospf cost 10
management-only
STANDBY ASA
Standby-ASA# sh run failover
failover
failover lan unit secondary
failover lan interface stateful1 GigabitEthernet0/3
failover key *****
failover link stateful1 GigabitEthernet0/3
failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
Standby-ASA# sh failover
Failover On
Failover unit Secondary
Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 160 maximum
Version: Ours 8.2(5), Mate 8.2(5)
Last Failover at: 20:39:23 CDT Sep 3 2013
This host: Secondary - Standby Ready
Active time: 2119 (sec)
slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
Interface outside (184.61.38.253): Normal
Interface inside (192.168.218.253): Normal
Interface dmz (192.168.215.252): Normal (Waiting)
Interface management (192.168.1.2): Normal (Not-Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
     IPS, 6.0(3)E1, Up
Other host: Primary - Active
Active time: 70110 (sec)
      slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
Interface outside (184.61.38.254): Normal
Interface inside (192.168.218.252): Normal
Interface dmz (192.168.215.254): Normal (Waiting)
Interface management (192.168.1.1): Normal (Not-Monitored)
slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
     IPS, 6.0(3)E1, Up
Standby-ASA# sh run interface
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
ospf cost 10
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
ospf cost 10
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
ospf cost 10
interface GigabitEthernet0/3
description LAN/STATE Failover Interface
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
ospf cost 10
management-only
Does anyone see something I might be missing? I am at a loss...

I'll just answer my own question...the configs are correct, but it the interface on the standby ASA was plugged into an improperly configured switchport. That'll do it everytime.

Step to prep CSC SSM on ASA Active/Standby mode

Hi all,
I am trying to setup Active/Standby HA mode for my site.
Currently the site was installed with one unit ASA firewall with CSC-SSM module, the second unit is the new unit ready to be setup.
My question:
01. My concern is second unit CSC-SSM, what is the proper procedure or step need to prep it?
Is it need to prep the CSC-SSM before the ASA in HA mode Or it will auto propagate the configuration when both unit in HA mode?
What else need to concern? am i need to setup different IP for the CSC-SSM management interface?
Thanks
Noel

Hello Yong,
Configuration related to the CSC or SSM modules will never get propagated so you will basically need to configure it manually.
Also it's not like if the Config on both modules is different failover will fail but ofcourse you wanna have the same one
IP addresses for each of the modules will be dedicated ones. Remember that failover will fail if one box has the CSC and the other not.
Looking for some Networking Assistance?
Contact me directly at [email protected]
I will fix your problem ASAP.
Cheers,
Julio Carvajal Segura
http://laguiadelnetworking.com

ASA Redundant interfaces with stack switches

Hi All,
we have two ASA 5510 connected in failover, and a pair of cisco 2960s switch connected in stack.
Currently one interface of primary ASA is terminated on switch1 and a interface from standby is connected to switch2 as Inside, and switch1 and switch2 are in stack.
for redundancy purpose i want to use multiple interfaces of ASA for inside , so first i thought to use etherchannel , but it has a limitation that , it cannot be terminated on stack switch(as per cisco document http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/general/interface_start.html ).
So my question is :
1. can we use redundant interface feature where 2 physical interfaces combined to a redundant interface (eg interface redundant 1) for inside redundancy purpose.
2. Can these ports from primary/standby ASA terminated on stack switches (2960s), will this work (if the switch with active port goes down, will the other port take over in the redundant interface with the other switch).
I have attached the nw diagram,
Regards,
Ashraf

Hello Ashraf,
1. can we use redundant interface feature where 2 physical interfaces combined to a redundant interface (eg interface redundant 1) for inside redundancy purpose.
Sure, you can. That's the whole purpose of the feature.
2. Can these ports from primary/standby ASA terminated on stack switches (2960s), will this work (if the switch with active port goes down, will the other port take over in the redundant interface with the other switch).
It would make sense if that happens, as the status of the interface will be on a different state than up/up so failover to the other interface will be triggered,
Regards,
Julio

USB ports don't work after resuming from standby with Windows 8 on X230 tablet

I have just done a clean install of Windows 8 on my X230 tablet. Before installing Windows 8 I installed the most recent BIOS for this machine (version 2.50). After installing Windows 8 I installed System Update from the Lenovo Website and downloaded all the recommended drivers and other files. I've also installed all the latest Windows 8 updates.
Here are the symptoms of my problem: After resuming from standby/sleep mode, my USB ports do not work. My computer has two USB 3.0 ports and one USB 2.0 ports. All exhibit the same behavior. After resuming from standby mode I have tried inserting both my mouse and a USB thumbdrive, but neither are recognized. After restarting Windows, the USB ports work again... until I resume from standby mode again.
I hope there is a solution to this issue. It is very frustrating.

Thanks for the suggestion about tweaking the "Allow this computer to turn off this device" feature. I un-checked that box for every entry I could find under "Universal Serial Bus Controllers" in the Devide Manager. Unfortunately, the same symptoms of my problem persisted.
I went back and looked at the README file associated with the BIOS 2.50 download on Lenvo's support site. At the bottom of the file it gives a "Summary of Changes". Under version 2.03 of the BIOS (the version just before version 2.50), it says:
- (Fix) Fixed an issue where USB device might not detected when system resume from sleep mode.
This indicates that Lenovo support was already aware of such issues. The problem was intended to be fixed in version 2.03 of the BIOS. However, the issue persists on my machine, even with the latest BIOS.
Hopefully someone from Lenovo can comment here.

ASA actice/standby with subinterface

Similar Messages

Maybe you are looking for