Fwsm - active/standby - "Vlan configuration mismatch between peers"

Hi,
A FWSM pair fall in to active active sittuation due to a vlan configuration mismatch. What would be the best way to synchronize configurations and return to the normal active/standbay? There is a new vlan on the primary fwsm and at present both are in active state.
Thank you in advance.
Zdravko

Hi,
To my understanding the FWSMs (even though both active) have identical configurations?
Have you perhaps done so that on the core switch you have only issued the "firewall vlan-group only on the primary core device (to which the FWSM is attached) and not the secondary core device?
The only time I have witnessed the same situation is when configuring a new customer link and I have only configured the primary unit (and about to configure the same on the standby unit)
Hope it helps, not sure if the above was what you meant.
- Jouni

Similar Messages

FWSM Active/Standby in VSS mode

hello,
i do have two 6500 in VSS mode , and one FWSM module on each 6500, i want to configure these modules as Active/Standby, how do i start , should i follow this (not in VSS mode):
http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/fail_f.html
or are there other things should i do to make it work,
thanks

up!

ASA 8.4 Active/Standby issue

Hi,
Have configured Active/Standby and configuration has been copied fine from one device to other.
All interfaces that have been auto created (to match the original device) are showing IP addresses correctly (UP,UP)
The ASA are connected via 2 switches using trunk ports and status is UP for both trunk ports (I have connected to the same ports as in original device)
Though it was going to work when the configuration transfer was completed and the same interfaces connected. Let me know if you can suggest why interfaces on the standby ASA when active become (UP, UP) with correct IP Addresses but no traffic passes except on the failover interface.
Thanks

in fact this is the problem that even after entering command "no failover active" on the Active ASA and therefore the second ASA becomes the Active one - still no traffic works except between the interfaces of the Failover between the two ASA's. So the second ASA is yes becoming Active but it seems that no device is able to communicate with it even if all its interfaces match the primary one.
Attached is a diagram of the setup.
(Update seems that isakmp site to site link is not coming up now - other than that internal communication is working from the ASA on failover)

Active/Standby Failover with pair of 5510s and redundant L2 links

Hi
I just got two ASA5510-SEC-BUN-K9 and I'm wondering is it possible to implement an Active/Standby Failover configuration (Routed mode) with two ASA5510 and redundant pair of switches from both inside and outside interfaces? In other words, I would like to have two L2 links from each ASA (in pair od ASAa) to each L2 switch (in pair of redundant L2 Switches). The configuration I would like to achive is just like one in Cisco Security Appliance Command Line Configuration Guide, page B-23, figure B-8, with only difference that I wouldn't go with multiple security contexts (I want Active/Standby failover).
Thanks in advance
Zoran Milenkovic

Hello Zoran,
Absolutely. You can have 2 ASAs configured in Active/Standby mode. For reference, here is a link which has a network connectivity diagram based on PIX, however, connectivity would still be same with ASAs-
http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/failover.html#wp1053462
The difference is that on ASA, you can only have LAN-Based failover, hence you'll need to use one additional interface on both ASAs for failover-link. You can connect these two failover-link interfaces directly using a cross cable.
Apart from this, please refer to following link on how to go with configuration of Lan-based Active/Standby failover-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1064158
Also make sure that both ASAs have required hardware/software/license based on following link-
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1047269
Hope this helps.
Regards,
Vibhor.

Active/standby in multiple context mode

is active/standby configuration possible in multilple context mode? i cannot find an article regarding this matter.

Hello John,
It is available
Actually the ones you need are the regular ones (documents) as the ASA will trigger failover if one of the context fail
Important Notes
For multiple context mode, the ASA can fail over the entire unit (including all contexts) but cannot fail over individual contexts separately.
. Active/Standby Failover is available on units that run in either single or multiple context mode. Both failover configurations support stateful or stateless (regular) failover.
VPN failover is not supported on units that run in multiple context mode as VPN is not supported in multiple context. VPN failover is available only for
Active/Standby Failover configurations in single context configurations.
With this I think you are ready to start configuring it:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807dac5f.shtml
Julio

FWSM move from Active/Standby to Active/active

Hi there,
we have some FWSM installed in 6500 with many contexts in them. They are at the moment configured as Active/Standby and in production. But we have noticed that whenever a backup is run which goes through some of the contexts, the FWSM start counting errors which was already determined to be an oversubscription issue. So, while we wait for the new ASA 5585X to arrive and finally replace them, we want to mitigate the issue by configuring the FWSM as Active/Active and move the contexts for backup traffic to the other box (keeping the production contexts in the other one).
My question is, can this be done without impacting the production traffic? Or as soon as we enable the active/active by the configuration of the groups and assignments of the contexts, the traffic will be impacted and we will produce an outage to the network?
Thanks in advance for your help.
Regards,
Paula

So no answers?
Just one to update why had problem here: we need to to pull changes from Physical StandBy, because of performance reasons we cannot afford to reload every table with full refresh, we only want to get changes. At first I thought that it will be easy just create materialized view log and do basic replication, but in Physical StandBy we cant do it

Active/Standby And failover link configuration mode

Hi everyone,
When config failover link of ASA in Active Standby mode.
When we config failover int say gi0/1
config t
int gi0/1
failover lan int gi0/1
Need to confirm we do this from interface config mode only or we can do this from global config also ????????
Whe we assign IP to this int we do that from global config mode ????
Regards
Mahesh
Message was edited by: mahesh parmar
Message was edited by: mahesh parmar

Hi,
Actually the ASA lets you insert a lot of command what ever mode you are under.
In the output you posted is a very important thing to notice
configure mode commands/options:
WORD Specify the interface name
As you can see, the output lists only one option and before that it mentions that this is a "configure mode" command
So even if you entered the command under the interface configuration mode, it would still be entered as a global/configure command mode.
Take the following thing for example
I want to check what configuration options I have with the command "failover"
So I enter the following to my ASA
ASA(config)# failover ?
configure mode commands/options:
interface              Configure the IP address to be used for failover and/or
                              stateful update information
interface-policy    Set the policy for failover due to interface failures
key                       Configure the failover shared secret or key
lan                       Specify the unit as primary or secondary or configure the
                               interface and vlan to be used for failover communication
mac                      Specify the virtual mac address for a dynamic interface
polltime                Configure failover poll interval
timeout                 Specify the failover reconnect timeout value for
                               asymmetrically routed sessions
exec mode commands/options:
active          Make this system to be the active unit of the failover pair
exec            Execute command on the designated unit
reload-standby Force standby unit to reboot
reset           Force a unit or failover group to an unfailed state
As you can see, the ASA tells us that there are different additional command parameters after the "failover" command that can be used. Some of them can be used either in Exec or Configuration mode.
- Jouni

FWSM 4.0: switch from active/standby to active/active failover mode

Hello,
I have a pair of FWSM's running version 4.0 currently in active/standby failover mode, and I'd like to switch them to be active/active. Is there a documented procedure for doing this? What are the implications for any contexts switched to be primary on the FWSM that is currently acting as a standby (i.e., what kind of outage time can we expect)?
Thanks in advance,
Mike

Hi Bro
Thanks for the update, but still you'll need to create 2 contexts, each context will be ACTIVE on different Cisco ASA FW units. Hence, there will be some cut, copy and paste effort, not forgetting recabling, if that's needed. Here's a Cisco document to configure ACTIVE/ACTIVE for those who can't seem to find this document http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml#req
Conclusion: There will be some network downtime. I'm guessing 15min, if it was me :-)
P/S: If you think this comment is helpful, please do rate it nicely :-)

Monitor interface vlan with ASA 5505 in HA Active/Standby Deployment

Hi,
I doing HA Active/Standby Deployment with two ASA 5505. ASA documents mention that it will monitor all physical interfaces itself to decide a failover. But in my case I configure vlan interface instead of physical interface. My inside interfaces in each ASA connect to two diferent Switches. My question is if one inside physical interface (lead to one switch) down, does the failover occur? I suspect it does not, but I would like to make sure before doing HA.
Any replies will be appreciated.

Hi, I usually instead of doing a cross-connect on the inside leave it to something like A-to-A and B-to-B if the switches are not doing VSS or VPC. So I would just connect eth0/7 from ASA-A to SW-A and similar on ASA-B. This makes it cleaner.
You can then control if you want to failover if the PO goes down or any 1 of the 2 interfaces in the PO go down.
I am not saying that your above design is invalid, but I have usually done this in the past.

ASA 5520: Configuring Active/Standby High Availability

Hi,
I am new to Cisco firewalls. We are moving from a different vendor to Cisco ASA 5520s.
I have two ASA 5520s running ASA 8.2(5). I am managing them with ASDM 6.4(5).
I am trying to setup Active/Standby using the High Availability Wizard. I have interfaces on each device setup with just an IP address and subnet mask. Primary is 10.1.70.1/24 and secondary is 10.1.70.2/24. The interfaces are connected to a switch and these interfaces are the only nodes on this switch. When I run the Wizard on the primary, configure for Active/Standby, enter the peer IP of 10.1.70.2 and I get an error message saying that the peer test failed, followed by an error saying ASDM is temporarily unable to connect to the firewall.
I tried this using a crossover cable to connect the interfaces directly with the same result.
Any ideas?
Thanks.
Dan

The command Varun is right.
Since you want to know a little bit more about this stuff, here goes a bit. Every interface will have a secondary IP and a Primary IP where the Active/Standby pair will exchange hello packes. If the hellos are not heard from mate, the the unit is delcare failed.
In case the primary is the one that gets an interface down, it will failover to the other unit, if it is the standby that has the problem, the active unit will declare the other Unit "standby failed). You will know that everything is alright when you do a show failover and the standby pair shows "Standby Ready".
For configuring it, just put a secondary IP on every interface to be monitored (If by any chance you dont have an available secondary IP for one of the interfaces you can avoid monitoring the given interface using the command no "monitor-interface nameif" where the nameif is the name of the interface without the secondary IP.
Then put the commands for failover and stateful link, the stateful link will copy the connections table (among other things) to avoid downtime while passing from One unit to another, This link should have at least the same speed as the regular data interfaces.
You can configure the failover link and the stateful link in just one interface, by just using the same name for the link, remember that this link will have a totally sepparate subnet from the ones already used in firewall.
This is the configuration
failover lan unit primary
failover lan interface failover gig0/3
failover link failover gig0/3
failover interface ip failover 10.1.0.1 255.255.255.0 standby 10.1.0.2
failover lan unit secondary
failover lan interface failover gig0/3
failover link failover gig0/3
failover interface ip failover 10.1.0.1 255.255.255.0 standby 10.1.0.2
Make sure that you can ping each other secondary/primary IP and then put the command
failover first on the primary and then on the secondary.
That would fine.
Let me know if you have further doubts.
Link for reference
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml
Mike

Configuration setup for active-standby and active-active

Hi
Having two sites separated by WAN and want to distribute the load between those two sites as Active-Active setup. want to whether it can be possible to have a active-standby pair at each site if not what is the work around to setup.

I would suggest the following setup as 'best practice' for this requirement.
At site A have a TimesTen A/S pair hosting data in range 'A' - 'M'. This provides local HA for this dataset. Remote readonly subscriber of this A/S pair located at site B. This provides read access to data 'A' - 'M' at site 'B'. in the event of a total failure of site A this remote subscriber can be converted into the active of a new A/S pair (located at site B).
Same setup in reverse for site B.
If the hardware is adequate you only need two machines at each site since you can host the readonly subscriber on the same machine as one of the local A/S pair datastores and if you need to do a site level failover you could host both A?S pair on a single pair of machines. Of course availability will be higher with 4 machines at each site. It is a cost/benefit trade off.
This is really the only viable/supported setup to have both sites active if using IMDB cache.
Chris

Admin TACACS+ access fails ASA in Active/Standby Configuration

We have two ASA 5510 with version 8.2(1) in Active/Standby configuration, the failover works fine, but when the primary ASA comes back it remains standby , so we manually change it to active with the failover active command, then we try to access the device using a TACACS+ account , it doesnt work , just the local account works; after a period of time (15min) , the TACACS+ access start to work.

I'm not sure about your configuration but when in timed mode, a server that is declared "failed" will once again
be made available after 30 seconds. Unlike reactivation mode, it is not
necessary for all of the servers to fail before any can be reactivated.
On possible source of confusion to be aware of in timed mode:
The "show aaa-server" command will continue to show the server as FAILED
until the server is needed to authenticate a connection.
depletion
Reactivates failed servers only after all of the servers in the group are inactive.
timed
Reactivates failed servers after 30 seconds of down time.
Please tweak reactivation mode.
Regards,
~JG
Do rate helpful posts

How to tell if Active/active or Active/Standby mode is configured?

Folks:
I am still learning the output of my running config, but how do I tell if my firewall is set to Actve/Active or Active/Standby mode?
In addition, how do I tell if it uses regular or stateful failover mode?
Thank you

I wanted to provide this as well, since I found it and it also helped me answering my question.
This output shows Active/Active failover output.
**Note** it says PIX; however, I beleive it will be the same output for ASA.
PIX1(config-subif)#show failover
Failover On
Cable status: N/A - LAN-based failover enabled
Failover unit Primary
Failover LAN Interface: LANFailover Ethernet3 (up)
Unit Poll frequency 15 seconds, holdtime 45 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 4 of 250 maximum
Version: Ours 7.2(2), Mate 7.2(2)
Group 1 last failover at: 06:12:45 UTC Apr 16 2007
Group 2 last failover at: 06:12:43 UTC Apr 16 2007
This host:    Primary
Group 1       State:          Active
                Active time:    359610 (sec)
Group 2       State:          Standby Ready
                Active time:    3165 (sec)
                  context1 Interface inside (192.168.1.1): Normal
                  context1 Interface outside (172.16.1.1): Normal
                  context2 Interface inside (192.168.2.2): Normal
                  context2 Interface outside (172.16.2.2): Normal
Other host:   Secondary
Group 1       State:          Standby Ready
                Active time:    0 (sec)
Group 2       State:          Active
                Active time:    3900 (sec)
                  context1 Interface inside (192.168.1.2): Normal
                  context1 Interface outside (172.16.1.2): Normal
                  context2 Interface inside (192.168.2.1): Normal
                  context2 Interface outside (172.16.2.1): Normal

ACE - active/standby

Hi Experts,
I have Two ACE modules in bridge mode and its configured as active/standby.
But I cannot ping to the gateway from standby ACE. from the msfc side all the configurations are ok.
Could you plz help us to find the root cause of this ?
Rgds
Aslam

Hi Aslam,
Can you please send me the config details of you admin Context by sending the output of the following commands:
# Show running-configuration
and
# show run ft
and # show ft group detail
I think there is some VLAN problem in your case either configured incorrectly or not included
Can you send your design
Like sample as follows:
FWSM--vlan 7--ACE-vlan 8---servers with default gateway as FWSM
Can you post the output for
show int vlan 505
sh arp
are you running ACE on a C6500 VSS pair?
Do you have an ip in your ACE vlan ?
If both of the device you are trying to ping are in the same VLAN as in ACE it does NOT route between VLANs so you cannot ping the interfaces in different VLANs.
Kindly send your config without which it will be difficult to figure out the exact root cause of your problem or any configuration mismatch.
Sachin Garg

Replacement of primary unit failed! (ASA5510 active/standby)

Hi all,
I have an issue bringing up my RMA'd primary ASA unit.
So what happened so far:
1. primary unit failed
2. secondary took over and is now secondary - active (as per sh fail)
2. requested RMA at Cisco
3. got ASA and checked that Lic (SSL), OS (8.2.2) and ASDM are at the same level as the secondary
4. issued wr erase and reloaded
5. copied the following commands to the new (RMA) primary unit:
failover lan unit primary
failover lan interface Failover Ethernet3
failover interface ip Failover 172.x.x.9 255.255.255.248 standby 172.x.x.10
int eth3
no shut
failover
wr mem
6. installed primary unit into rack
7. plugged-in all cables (network, failover, console and power)
8. fired up the primary unit
9. expected that the unit shows:
Detected an Active mate
Beginning configuration replication from mate.
End configuration replication from mate.
10. but nothing happened on primary unit
So can anyone give me assistance on what is a valid and viable approach in replacing a failed primary unit? Is there a missing step that hinders me to successfully replicate the secondary - active config to the primary - standby unit.
I was looking for help on the net but unfortunately I was not able to find anything related to ASA55xx primary unit replacement with a clear guideline or step by step instructions.
Any comments or suggestions are appreciated, and might help others who are in the same situation.
Thanks,
Nico

Hi Varun,
Thanks for catching-up this thread.
Here you go:
sh run fail on secondary - active:
failover
failover lan unit secondary
failover lan interface Failover Ethernet0/3
failover key *****
failover link Failover Ethernet0/3
failover interface ip Failover 172.x.x.9 255.255.255.248 standby 172.x.x.10
sh fail hist on secondary - active:
asa1# sh fail hist
==========================================================================
From State                 To State                   Reason
==========================================================================
23:47:15 CEST Feb 19 2011
Not Detected               Negotiation                No Error
23:47:19 CEST Feb 19 2011
Negotiation                Cold Standby               Detected an Active mate
23:47:21 CEST Feb 19 2011
Cold Standby               Sync Config                Detected an Active mate
23:47:36 CEST Feb 19 2011
Sync Config                Sync File System           Detected an Active mate
23:47:36 CEST Feb 19 2011
Sync File System           Bulk Sync                  Detected an Active mate
23:47:50 CEST Feb 19 2011
Bulk Sync                  Standby Ready              Detected an Active mate
10:34:09 CEDT Sep 3 2011
Standby Ready              Just Active                HELLO not heard from mate
10:34:09 CEDT Sep 3 2011
Just Active                Active Drain               HELLO not heard from mate
10:34:09 CEDT Sep 3 2011
Active Drain               Active Applying Config     HELLO not heard from mate
10:34:09 CEDT Sep 3 2011
Active Applying Config     Active Config Applied      HELLO not heard from mate
10:34:09 CEDT Sep 3 2011
Active Config Applied      Active                     HELLO not heard from mate
==========================================================================
sh fail on secondary - active
asa1# show fail
Failover On
Failover unit Secondary
Failover LAN Interface: Failover Ethernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 110 maximum
Version: Ours 8.2(2), Mate 8.2(2)
Last Failover at: 10:34:09 CEDT Sep 3 2011
        This host: Secondary - Active
                Active time: 441832 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.2(2)) status (Up Sys)
                  Interface Outside (x.x.x.14): Normal (Waiting)
                  Interface Inside (x.x.x.11): Normal (Waiting)
                slot 1: empty
        Other host: Primary - Failed
                Active time: 40497504 (sec)
                slot 0: ASA5510 hw/sw rev (2.0/8.2(2)) status (Unknown/Unknown)
                  Interface Outside (x.x.x.15): Unknown
                  Interface Inside (x.x.x.12): Unknown
                slot 1: empty
Stateful Failover Logical Update Statistics
        Link : Failover Ethernet0/3 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         2250212    0          64800624   309
        sys cmd         2250212    0          2249932    0
        up time         0          0          0          0
        RPC services    0          0          0          0
        TCP conn        0          0          46402635   309
        UDP conn        0          0          21248      0
        ARP tbl         0          0          15921639   0
        Xlate_Timeout   0          0          0          0
        IPv6 ND tbl     0          0          0          0
        VPN IKE upd     0          0          96977      0
        VPN IPSEC upd   0          0          108174     0
        VPN CTCP upd    0          0          19         0
        VPN SDI upd     0          0          0          0
        VPN DHCP upd    0          0          0          0
        SIP Session     0          0          0          0
        Logical Update Queue Information
                        Cur     Max     Total
        Recv Q:         0       17      203259096
        Xmit Q:         0       1       2250212
show ver on secondary - active
asa1# sh ver
Cisco Adaptive Security Appliance Software Version 8.2(2)
Device Manager Version 6.2(5)53
Compiled on Mon 11-Jan-10 14:19 by builders
System image file is "disk0:/asa822-k8.bin"
Config file at boot was "startup-config"
asa1 up 200 days 12 hours
failover cluster up 1 year 108 days
Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
Slot 1: ATA Compact Flash, 64MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Ext: Ethernet0/0         : address is 0022.55cf.7420, irq 9
1: Ext: Ethernet0/1         : address is 0022.55cf.7421, irq 9
2: Ext: Ethernet0/2         : address is 0022.55cf.7422, irq 9
3: Ext: Ethernet0/3         : address is 0022.55cf.7423, irq 9
4: Ext: Management0/0       : address is 0022.55cf.741f, irq 11
5: Int: Not used            : irq 11
6: Int: Not used            : irq 5
Licensed features for this platform:
Maximum Physical Interfaces    : Unlimited
Maximum VLANs                  : 100
Inside Hosts                   : Unlimited
Failover                       : Active/Active
VPN-DES                        : Enabled
VPN-3DES-AES                   : Enabled
Security Contexts              : 2
GTP/GPRS                       : Disabled
SSL VPN Peers                  : 10
Total VPN Peers                : 250
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials          : Disabled
Advanced Endpoint Assessment   : Disabled
UC Phone Proxy Sessions        : 2
Total UC Proxy Sessions        : 2
Botnet Traffic Filter          : Disabled
This platform has an ASA 5510 Security Plus license.
Serial Number: xxx
Running Activation Key:xxxx
Configuration register is 0x1
Configuration last modified by enable_1 at 10:05:32.149 CEDT Fri Jul 15 2011

Fwsm - active/standby - "Vlan configuration mismatch between peers"

Similar Messages

Maybe you are looking for