ASA5512 Active/Standby with Firepower services

I have two ASA5512X firewalls in Active/Standby mode.
We want now to enable FirePOWER subscription- TAMC - IPS and Apps Updates plus URL Filtering and AMP Subscription
My customer does not want to buy the subscription for the standby firewall.
He needs the standby firewall to do only firewalling, routing and VPN in the event of a failure.
Is it technically possible?

technically it would work. The service policy would still direct the traffic through the FirePOWER module that's unlicensed (The base FirePOWER software would have to be installed but without any license or policies from FMC).

Similar Messages

[HA]ASA with FirePOWER Services with [HA]FireSIGHT Management Center

Hi,
My Customer orders the following SKUs in one to make these ASA with FirePOWER Services as H/A.
Line
Number
Item Name
Description
Service
Duration
Lead
Time
Included
Item
Quantity
ListPrice
Extended
ListPrice
Discount
Selling
Price
1.0
ASA5515-FPWR-K9
ASA 5515-X with FirePOWER Services 6GE AC 3DES/AES SSD
N/A
14 days
No
2
2.0
L-ASA5515-TAMC=
Cisco ASA5515 FirePOWER IPS AMP and URL Licenses
N/A
0 days
No
2
2.0.1
L-ASA5515-TAMC-1Y
Cisco ASA5515 FirePOWER IPS AMP and URL 1YR Subs
12 month(s)
N/A
No
2
Assuming from my experiences, 2 PAKs are supposed to be issued.
PAK_A : 1 PAK for ASA5515-CTRL-LIC (Entitlement Qty:2)
PAK_B: 1 PAK for L-ASA5555-TAMC= (Entitlement Qts:2)
Also these FireSIGHTs which monitors these ASAs are H/A.
The SKUs of FireSIGHTs are following:
-FS1500-K9
-FS1500-BASE-K9
In this case, I assume that these steps are necessary for generating licenses for ASA with FirePOWER Servies;
Go to license page ( www.cisco.com/go/license) and input PAK_A. Then following the steps and on “Add Device”section, should I input the following 3 devices license keys ?
-Another ASA5515-FPWR-K9
-FS1500-K9
-FS1500-BASE-K9
And then 2 licenses which are one is for FS1500-K9 and the other is for FS1500-BASE-k9 are to be generated.
*I have to do that same operation for PAK_B.
Q1: Is this right? Do I understand the steps correctly ?
Q2 :If the answer for Q1 is Yes, does it mean that any license is not required for ASA with FirePOWER services ?

Hi,
For the PIDs "ASA5515-CTRL-LIC" and "L-ASA5555-TAMC=" you will be provided with PAKs.
If you are trying to setup HA please check on the forum link for HA setup, https://supportforums.cisco.com/discussion/12320876/how-can-i-make-my-license-high-availabilityor-ha-license
Steps to register the PAK,
1) Login to License portal ( www.cisco.com/go/license) with CCO ID
2) Enter the PAK to register, click NEXT
3) Enter the license key of the FireSight device (like FS1500) and if you want to add more devices for HA click on ADD device
4) enter the license key of the second FireSIGHT for HA, click NEXT
5) Agree to the terms and SUBMIT
6) email with the licenses will be sent

PROBLEM IN ACTIVATING BB WITH ANOTHER SERVICE PROVIDER

Hi !!!
i had purchased BB from tata indicom , recently i changed service provider from tataindicom to idea with Number portability option ... no. is same but idea is not able to register my BB with there services .....please guide me.
rishiraj

Hi and Welcome to the Community!
Firstly, you must have your BB unlocked from the original carrier:
http://www.blackberryfaq.com/index.php/How_do_I_unlock_my_BlackBerry%3F
After that, your new carrier should be able to get it going for basic voice-level services. For advanced BB-level services, they will need to work harder in order for your BB to receive the required Service Books. Hopefully they know how to do that.
Good luck!
Occam's Razor nearly always applies when troubleshooting technology issues!
If anyone has been helpful to you, please show your appreciation by clicking the button inside of their post. Please click here and read, along with the threads to which it links, for helpful information to guide you as you proceed. I always recommend that you treat your BlackBerry like any other computing device, including using a regular backup schedule...click here for an article with instructions.
Join our BBM Channels
BSCF General Channel
PIN: C0001B7B4 Display/Scan Bar Code
Knowledge Base Updates
PIN: C0005A9AA Display/Scan Bar Code

ASA actice/standby with subinterface

I try to configure active/standby with ASA5520 Version 8.0(2). In configuration guide I read:
The if_name argument assigns a name to the interface specified by the phy_if argument. The phy_if argument can be the physical port name, such as Ethernet1, or a previously created subinterface, such as Ethernet0/2.3.
But when I try to do this, I get an error message:
ERROR: Can not configure failover interface on a shared physical interface
What is going wrong?

If I recall correctly from my ASA setup (about 14 months ago so I could be mistaken), we tried setting our failover interface on a sub-interface and it didnt work. I then took a look at some Cisco documentation and they suggest that you use a dedicated interface for Failover (that is what we did). We have 1 interface for failover, 1 for DMZ, 1 for Outside and 1 for Inside and everything is functioning correctly. I am trying to find the link I used from Cisco when researching this, but I am fairly sure that was what I came up with.
Hope this helps
Chris

ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
This topic has been beat to death, but I did not see a real answer. Here is configuration:
1) 2 x ASA 5520, running 8.2
2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
In any case, any experts out there that can answer question? TIA!

Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
Thanks much,
Mike

I have "chatted" with customer service 5 different times. I was sent here. I have activated Photoshop Elements 9 on two different iMacs. They are both dead and I am unable to get it to activate on my newest computer. iMac. Can anybody help me?

I have "chatted" with customer service 5 different times. I was sent here. I have activated Photoshop Elements 9 on two different iMacs. They are both dead and I am unable to get it to activate on my newest computer. iMac. Can anybody help me?

Unfortunately, only adobe can help you with that, as most people here are just posters such as your self and don't work for adobe.
If you go here and use the Chat now button (bottom of page), they should get you up and running by resetting your activations.
http://helpx.adobe.com/x-productkb/policy-pricing/activation-deactivation-products.html

CAF entity coupled with application service activation problem

Hi Experts,
I have an existing CAF entity service to which i had added an additional attribute.
I have the assosiated application application setdataservice,which has a custom method to add data to the entity service (mass upload).
In the custom method i have added the code to set data for the addtional attribute.
I had generated the project and build the dc locally,
The buid is fine with no error's .
But when I activate the request the activity fails with "cannot resolve symbol" for the new method even though the local build is sucessful.
Any idea why this is occuring,
ERROR: /NWDI/usr/sap/DIP/JC37/j2ee/cluster/server0/temp/CBS/c6/.B/28783/DCs/spe.com/portal/prc_core/ejbmodule/_comp/ejbModule/com/spe/portal/prc_core/appsrv/setdataservice/SetDataServiceBean.java:3434: cannot resolve symbol [javac] ERROR: symbol : method setFixPromvalue (double) [javac] ERROR: location: class com.spe.portal.prc_core.besrv.int_promocodes.Int_PromoCodes [javac] ERROR: promoCode.setFixPromvalue(fixPromValue); [javac] ERROR: ^ [javac] 1 error Error: /NWDI/usr/sap/DIP/JC37/j2ee/cluster/server0/temp/CBS/c6/.B/28783/DCs/spe.com/portal/prc_core/ejbmodule/_comp/gen/default/logs/build.xml:111: Compile failed; see the compiler error output for details. at org.apache.tools.ant.taskdefs.Javac.compile(Javac.java:938) at org.apache.tools.ant.taskdefs.Javac.execute(Javac.java:758) at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) at org.apache.tools.ant.Task.perform(Task.java:364) at org.apache.tools.ant.Target.execute(Target.java:341) at org.apache.tools.ant.Target.performTasks(Target.java:369) at org.apache.tools.ant.Project.executeTarget(Project.java:1214) at com.sap.tc.buildplugin.techdev.ant.util.AntRunner.run(AntRunner.java:112) at com.sap.tc.buildplugin.DefaultAntBuildAction.execute(DefaultAntBuildAction.java:61) at com.sap.tc.buildplugin.DefaultPlugin.handleBuildStepSequence(DefaultPlugin.java:213) at com.sap.tc.buildplugin.DefaultPlugin.performBuild(DefaultPlugin.java:190) at com.sap.tc.buildplugin.DefaultPluginV3Delegate$BuildRequestHandler.handle(DefaultPluginV3Delegate.java:66) at com.sap.tc.buildplugin.DefaultPluginV3Delegate.requestV3(DefaultPluginV3Delegate.java:48) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at com.sap.tc.buildtool.v2.impl.PluginHandler2.maybeInvoke(PluginHandler2.java:350) at com.sap.tc.buildtool.v2.impl.PluginHandler2.request(PluginHandler2.java:102) at com.sap.tc.buildtool.v2.impl.PluginHandler2.build(PluginHandler2.java:76) at com.sap.tc.buildtool.PluginHandler2Wrapper.execute(PluginHandler2Wrapper.java:58) at com.sap.tc.devconf.impl.DCProxy.make(DCProxy.java:1723) at com.sap.tc.devconf.impl.DCProxy.make

Hi again,
I've deleted the two methods (or just commented them) I had and have readded them by choosing the Override Method option in the Source menu of JDeveloper 10.1.3. I've addet the methods prepareForActivation and prepareForPassivation too.
When I execute the application, with breakpoints into the four methods (I attach the code below), I see that it prepares for pasivation and pasivates. When I do any action, I see it prepares for activation, but the method activateState is never reached.
I have no other overriden methods in the class. Any idea of why the activateState doesn't execute?
Thanks,
Carles Biosca
BBR Ingeniería de Servicios
   protected void activateState(Element element) {
       super.activateState(element);
   protected void passivateState(Document document, Element element) {
       super.passivateState(document, element);
   protected void prepareForActivation(Element element) {
       super.prepareForActivation(element);
   protected void prepareForPassivation(Document document, Element element) {
       super.prepareForPassivation(document, element);
   }Message was edited by:
cbios

11.2.0.3 RAC ASM Pri with Normal FileSys Active Standby Post Failover

The architecture consist of two node rac asm primary and one normal filesystem active standby all on Oracle 11gR2 11.2.0.3. With basic Broker Configuration.
Performed a managed broker switchover and not the Normal Filesystem has the primary role and the standby consist of the two node asm rac. I want to switchback, i.e., Former Primary -> Primary Role and Former Standby -> Standby Role.
However my broker contains the following:
DGMGRL> show configuration verbose;
Configuration - DG_PRI_CFG
Protection Mode: MaxPerformance
Databases:
STANDBY - Primary database
Warning: ORA-16829: fast-start failover configuration is lagging
KEMETRAC - (*) Physical standby database
Error: ORA-16810: multiple errors or warnings detected for the database
(*) Fast-Start Failover target
Properties:
FastStartFailoverThreshold = '95'
OperationTimeout = '30'
FastStartFailoverLagLimit = '95'
CommunicationTimeout = '180'
FastStartFailoverAutoReinstate = 'TRUE'
FastStartFailoverPmyShutdown = 'TRUE'
BystandersFollowRoleChange = 'ALL'
Fast-Start Failover: ENABLED
Threshold: 95 seconds
Target: KEMETRAC
Observer: emcc.respecti.com
Lag Limit: 95 seconds
Shutdown Primary: TRUE
Auto-reinstate: TRUE
Configuration Status:
ERROR
I've found a recommendation to increase the value of FastStartFailoverThreshold='90';
Though I continue to encounter the above configuration error.
Recommendations are appreciated!
Edited by: 783527 on Mar 12, 2012 7:41 PM

03/13/2012 13:13:22
Data Guard Broker Status Summary:
Type Name Severity Status
Configuration DG_PRI_CFG Warning ORA-16607
Primary Database STANDBY Warning ORA-16829
Physical Standby Database KEMETRAC Error ORA-16810
03/13/2012 13:14:22
Data Guard Broker Status Summary:
Type Name Severity Status
Configuration DG_PRI_CFG Warning ORA-16607
Primary Database STANDBY Warning ORA-16829
Physical Standby Database KEMETRAC Error ORA-16810
03/13/2012 13:15:22
Data Guard Broker Status Summary:
Type Name Severity Status
Configuration DG_PRI_CFG Warning ORA-16607
Primary Database STANDBY Warning ORA-16829
Physical Standby Database KEMETRAC Error ORA-16810
03/13/2012 13:16:22
Data Guard Broker Status Summary:
Type Name Severity Status
Configuration DG_PRI_CFG Warning ORA-16607
Primary Database STANDBY Warning ORA-16829
Physical Standby Database KEMETRAC Error ORA-16810
03/13/2012 13:17:22
Data Guard Broker Status Summary:
Type Name Severity Status
Configuration DG_PRI_CFG Warning ORA-16607
Primary Database STANDBY Warning ORA-16829
Physical Standby Database KEMETRAC Error ORA-16810
03/13/2012 13:18:22

Resource com.sap.aii.af.svc with type service, not active on the server

Hi Forum,
in my X1 server, in rwb, it gave error:
HTTP request failed. Error code: "503". Error message: "Service Unavailable [http://xyz:50000/AdapterFramework/rtc,
on further analysis we find that:
<b> Application cannot be started.
Details: com.sap.engine.services.deploy.container.ExceptionInfo: Application sap.com/com.sap.xi.mdt cannot be started. Reason: it has hard reference to resource com.sap.aii.af.svc with type service, which is not active on the server.</b>
and the service/component com.sap.aii.af.svc is not present as the error says,
In visual admin, in the services list i couldnt find this particular resource,
pls instruct me how to deploy/start this service com.sap.aii.af.svc ,

Hi,
Please check out the user authorization and role and also check that you are maintaining the passwords in all places where required.
Regards
Aashish Sinha
PS : reward points if helpful

ASA 8.2 8.4 9.1 possible with no downtime as we run active/standby?

Hello,
We have 2 x ASA 5520s (with 2GB mem) in active/standby mode, they also include the IPS modules.
The current firmware is 8.2 and I was wondering if it is possible to upgrade these firewalls with no downtimes? In the past I have upgraded the standby ASA, rebooted it and then made it the active ASA then upgraded the new standby ASA.
I have have quite a lot of NAT Exempts (No-NATs?) and a few static NATs, how did you approach this during your upgrades?
I guess I can roll back as the 8.2 firmware will still be on the flash and I will have the config?
Thanks

Yeah it's supported:
Release Notes for the Cisco ASA Series, 9.1(x)
http://www.cisco.com/en/US/docs/security/asa/asa91/release/notes/asarn91.html#wp732442
This document has the information that you need; it talks about the requirements and zero downtime procedure.
But you need to take a lot of considerations that you can reference in the document:
https://supportforums.cisco.com/docs/DOC-12690
If you don't mind me asking why are you upgrading?
Because of a fix or feature?

Replication with Domain and Sub domain in Active directory sites and services

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically because
it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?

I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically
because it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?
Two way transitive trusts are configured automatically when you create a child domain or tree root domain. You don't have to worry about site/subnet or replication part at least from trust perspective. But make sure site's names are unique in each domain.
How Domain and Forest Trusts Work
http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc730868.aspx
http://blogs.technet.com/b/askds/archive/2008/09/24/domain-locator-across-a-forest-trust.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Insert multi-users for activity with web services

Hi guru,
Can anyone send me some sample code to add more than users to activity with web services, and any field are the required fields. I am using web services 2.0
Thanks

Hi,
I think you'll find you get a better response from the CRM On Demand Integration Development forum, this forum is just about the Administration of the system not integration.
cheers
Alex

ASA failover with 1 AIP SSM in Active/Standby?

I have a customer with two ASAs; in Active/Standby. They want to purchase one AIP. Will failover (without the AIP functionality) to the Standby work if the AIP is configured for Promiscuous mode? Thanks, Bob

The only connection to the SSM that can be done internally through the ASA is a "session". This is an internal telnet to the SSM and can be used to access the SSM's CLI.
This is very usefull when you manage your SSM directly through the CLI.
However, most customers prefer to use a graphics based tool like IDM, ASDM, or CSM for managing the configuration of the SSM, and prefer to use a graphics based tool like IEV or CS MARS for monitoring of the alerts from the SSM.
All of these graphics based tools need network access to the SSM through a web port (https on port 443 by default). Access to this port is not allowed internally through the ASA direct to the SSM.
All web connections must be made to the External Management interface of the SSM.
If you are not using all 4 of your ASA interfaces you could choose to wire the External SSM interface directly to one of your ASA interfaces, and create a small subnet for the ASA and IPS IP Addresses. So then all external connections to the SSM would be routed into the ASA, then out of the ASA, and into the external port of the SSM.
That subnet of just the ASA and SSM could be made using a network reserved for local IPs (like a 10, or 172, or 192 network) and then use NAT/PAT for translation on the other network interfaces of the ASA.
But it does still require that wire connected to the external port of the SSM.

Active/Standby Failover with pair of 5510s and redundant L2 links

Hi
I just got two ASA5510-SEC-BUN-K9 and I'm wondering is it possible to implement an Active/Standby Failover configuration (Routed mode) with two ASA5510 and redundant pair of switches from both inside and outside interfaces? In other words, I would like to have two L2 links from each ASA (in pair od ASAa) to each L2 switch (in pair of redundant L2 Switches). The configuration I would like to achive is just like one in Cisco Security Appliance Command Line Configuration Guide, page B-23, figure B-8, with only difference that I wouldn't go with multiple security contexts (I want Active/Standby failover).
Thanks in advance
Zoran Milenkovic

Hello Zoran,
Absolutely. You can have 2 ASAs configured in Active/Standby mode. For reference, here is a link which has a network connectivity diagram based on PIX, however, connectivity would still be same with ASAs-
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/failover.html#wp1053462
The difference is that on ASA, you can only have LAN-Based failover, hence you'll need to use one additional interface on both ASAs for failover-link. You can connect these two failover-link interfaces directly using a cross cable.
Apart from this, please refer to following link on how to go with configuration of Lan-based Active/Standby failover-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1064158
Also make sure that both ASAs have required hardware/software/license based on following link-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1047269
Hope this helps.
Regards,
Vibhor.

RMAN Connections To Primary DB While Creating Standby With Active Database

OS Version : AIX 6.1
DB Version : 11.2.0.1
I am creating a standby database with active database option (without any backups). When i am checking number of connections in my primary database, i can see 3 rman connections
from the standby machine. How oracle reaches to a conclusion of 3 sessions ? Is this number fix or this number can be manipulated with requirment ?
SQL> select sid,serial#,program from v$session;
       SID    SERIAL# PROGRAM
         1          1 oracle@cph-core-db01-s (DIA0)
         2          1 oracle@cph-core-db01-s (MMNL)
         3          1 oracle@cph-core-db01-s (QMNC)
        32          1 oracle@cph-core-db01-s (MMAN)
        33          1 oracle@cph-core-db01-s (DMON)
        34          3 oracle@cph-core-db01-s (Q000)
        63          1 oracle@cph-core-db01-s (PMON)
        64          1 oracle@cph-core-db01-s (DBW0)
        65          3 sqlplus@cph-core-db01-s (TNS V1-V3)
        66         10 oracle@cph-core-db01-s (Q001)
        94          1 oracle@cph-core-db01-s (VKTM)
       SID    SERIAL# PROGRAM
        95          1 oracle@cph-core-db01-s (LGWR)
        96          3 oracle@cph-core-db01-s (INSV)
        *97         27 rman@cph-core-db02-s (TNS V1-V3)*
       125          1 oracle@cph-core-db01-s (GEN0)
       126          1 oracle@cph-core-db01-s (CKPT)
       127          3 oracle@cph-core-db01-s (ARC0)
       *129         18 rman@cph-core-db02-s (TNS V1-V3)*
       156          3 oracle@cph-core-db01-s (ARC1)
       157          1 oracle@cph-core-db01-s (DIAG)
       158          1 oracle@cph-core-db01-s (SMON)
       159         12 oracle@cph-core-db01-s (SMCO)
       SID    SERIAL# PROGRAM
       187          1 oracle@cph-core-db01-s (DBRM)
       188          1 oracle@cph-core-db01-s (RECO)
       189          1 oracle@cph-core-db01-s (ARC2)
       192          2 oracle@cph-core-db01-s (W000)
       218          1 oracle@cph-core-db01-s (PSP0)
       219          1 oracle@cph-core-db01-s (MMON)
       221          1 oracle@cph-core-db01-s (ARC3)
       *222          3 rman@cph-core-db02-s (TNS V1-V3)*

Check for the RMAN parallelism in standby database it might be set to 3.
RMAN> show all;
or
Might be you had allocated 3 channels while executing active standby database query.

ASA5512 Active/Standby with Firepower services

Similar Messages

Maybe you are looking for