Manual failover of ASA

I have 2 ASA 5510 with image 8.21. When I have to switch from main ASA to BKP ASA, I boot my BKP ASA and then unplug the cables manually from main ASA and plug them into BKP ASA.
But the problem is that I become unable to access the internet for a very long time. When I see logs via ASDM (since its easy to handle through GUI) then it gives a lot of logs of deny connection inbound. when I plug the cables back into main ASA the internet connectivity resumes and outside clients also resume to access inbound services.
Do I need to give any extra command on the BKP ASA when I put it into line ?
Plz help :(

I don't know why it would take 10 to 15 minutes for TCP applications to recover. Do new connections pass through the firewall? Maybe you have some ARP caching or possibly switch port security is causing delays learning the new MAC address of the secondary firewall.
You can still configure HA assuming you have available upstream switch ports. Here is what you can do:
1. Configure HA on the primary firewall and configure the secondary firewall's failover link per the link I previously sent. You'll need stateful failover to maintain connections during a failover.
2. Connect the secondary firewall's failover interface to the primary firewall's failover interface.
3. The primary should begin to push the config over to the secondary.
4. Run "show failover state" and confirm the secondary is listed as standby.
5. Connect the remaining interfaces on the secondary to your upstream switch.
6. Run "show failover state" again and confirm the secondary is listed as Standby Ready.
7. You can now gracefully failover by running "failover active" on your secondary firewall.
For future failovers you can just plug in your secondary firewall and repeat steps 6 and 7.

Similar Messages

How to Perform Forced Manual Failover of Availability Group (SQL Server) and WSFC (Windows Server Failover Cluster)

I have a scenario with the three nodes with server 2012 standard, each running an instance of SQL Server 2012 enterprise, participate in a
single Windows Server Failover Cluster (WSFC) that spans two data centers.
If the nodes in the primary data center are unavailable due to data center outage. Then how I can able to access node in the WSFC (Windows Server Failover Cluster) in the secondary disaster recovery data center automatically with some script.
I want to write script that can be able to check primary data center by pinging some IP after every 5 or 10 minutes.
If that IP is unable to respond then script can be able to Perform Forced Manual Failover of Availability Group (SQL Server) and WSFC (Windows Server Failover Cluster)
Can you please guide me for script writing for automatic failover in case of primary datacenter outage?

please post you question on failover clusters in the cluster forum. THey will explain how this works and point you at scipts.
You should also look in the Gallery for cluster management scripts.
¯\_(ツ)_/¯

How to Perform Forced Manual Failover of Availability Group (SQL Server) and WSFC (Windows Server Failover Cluster) with scrpiting

I have a scenario with the three nodes with server 2012 standard, each running an instance of SQL Server 2012 enterprise, participate in a
single Windows Server Failover Cluster (WSFC) that spans two data centers.
If the nodes in the primary data center are unavailable due to data center outage. Then how I can able to access node in the WSFC (Windows Server Failover Cluster) in the secondary disaster recovery data center automatically with some script.
I want to write script that can be able to check primary data center by pinging some IP after every 5 or 10 minutes.
If that IP is unable to respond then script can be able to Perform Forced Manual Failover of Availability Group (SQL Server) and WSFC (Windows Server Failover Cluster)
Can you please guide me for script writing for automatic failover in case of primary datacenter outage?

You are trying to implement manually what should be happening automatically in the cluster. If the primary SQL Server becomes unavailable in the data center, it should fail over to the secondary SQL Server automatically. Is that not working?
You also might want to run this configuration by some SQL experts. I am not a SQL expert, but if you have both hosts in the data center in a cluster, there is no need for replication between those two nodes as they would be accessing
the database from some form of shared storage. Then it looks like you are trying to implement Always On to the DR site. I'm not sure you can mix both types of failover in a single configuration.
FYI, it would make more sense to establish a file share witness in your DR site instead of placing a third node in the data center for Node Majority quorum.
. : | : . : | : . tim

Perform Forced Manual Failover of Availability Group (SQL Server 2012) and WSFC (Windows Server Failover Cluster)

I have a scenario with the three nodes with server 2012 standard, each running an instance of SQL Server 2012 enterprise, participate in a
single Windows Server Fail-over Cluster (WSFC) that spans two data centers.
If the nodes in the primary data center are unavailable due to data center outage. Then how I can able to access node in the WSFC (Windows Server Fail-over Cluster) in the secondary disaster recovery data center automatically with some script.
I want to write script that can be able to check primary data center by pinging some IP after every 5 or 10 minutes.
If that IP is unable to respond then script can be able to Perform Forced Manual Fail-over of Availability Group (SQL Server) and WSFC (Windows Server Fail-over Cluster)
Can you please guide me for script writing for automatic fail-over in case of primary data-center outage?

+1 to David's comment. I would not suggest to run a script automatically. During such failover you might have data loss and decision has to be made with business owners during disaster.
During such situation, you need to start cluster service in force quorum mode (/fq switch) and then perform manual failover of AG to DR site.
Balmukund Lakhani
Please mark solved if I've answered your question, vote for it as helpful to help other users find a solution quicker
This posting is provided "AS IS" with no warranties, and confers no rights.
My Blog |
Team Blog | @Twitter
| Facebook
Author: SQL Server 2012 AlwaysOn -
Paperback, Kindle

After a manual failover , getting back the old primary to work

Hi All,
i am testing some DG features
i did a manual failover by shutdown abort the primary and amek the physical standby as the new primary.
now suppose my clients work for 1 day on the new primary , and i want to get back the old primary to be a primary again
Do i need to create a new db from the new primary and switchover , any other shorter way to do it ?
Thanks

Hi..
I think that is the best method.Using RMAN create a new standby database on the previous primary server and the do a switchover to it.If the database is not too big you can go for schema level exp/imp or (expdp/impdp) depending on the oracle version you are using as you haven't mentioned it.But, then you will have to create a new standby database later and moreover, there could be loss of some data.
Anand

Manual failover solution for a custom proxy service that should be deployed

I am looking for a manual failover solution for a custom proxy service that should be deployed on a cluster as a pinned service (requests have to be executed one after the other). The constraints I am encountering are:
a) Proxy service are deployed to all cluster's members by default.
b) Configuration of proxy services to cope with migration of JMS ressources.
Any idea?
Thanks in advance for your support
Fred

hi leroy,
this is the OracleAS Portal Content Management forum. Please post your question in the Database forum
General Database Discussions
thanks,
christian

Sap not starting during manual failover testing

Dera friends,
We are performing manual failover testing between CI(sap central instance) and DB(oracle database)
the environment is ECC6.0 on AIX server
CI is running on one server and DB is running on another, during manual testing we have failed the DB, so now DB file systems has got mounted on CI server.
So when i log into CI with user as shown below (sid-irp)
su - irpadm
and the execute the command as shown below
irpadm 6> startsap
i get the following message
PRDCIXI:irpadm 6> startsap
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
Checking IRP Database
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
ABAP Database is not available via R3trans
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
Starting SAP-Collector Daemon
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
15:03:05 26.09.2008   LOG: Effective User Id is root
This is Saposcol Version COLL 20.94 700 - AIX v10.35 5L-64 bit 070123
Usage: saposcol -l: Start OS Collector
        saposcol -k: Stop OS Collector
        saposcol -d: OS Collector Dialog Mode
        saposcol -s: OS Collector Status
The OS Collector (PID 1101932) is already running .....
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
saposcol already running
tee: 0652-044 Cannot open /home/irpadm/startsap_.log.
ABAP Database IRP must be started on remote server
===============================================
why am i getting this "ABAP Database IRP must be started on remote server" message.
What could be the cause for my database not comming up & why is it looking for remote server, when all the DB filesystems have got mounted on CI server (the server that has CI installed)
We are in a bad shape and the issue is quite crticial.
Your reply would be highly appreciated.
Regards
Ayush

> how can i check wether the directories are missing or not...
mount?
> Also how can i check it wether they are assigned to failover group or not.
Ayush, no offense, but I suggest you contact your AIX guy and check with him together. It's very cumbersome to write down command by command, get the outpu t back and you have no clue what you are doing. Again, no offense.
Markus

What does Lync automatic/Manual Failover between sites

Hi,
I have 2 Lync sites. Each site has one FE pool with 3 FE servers. Each Pool has dedicated one BE server
I configured backup pool relationship with each other. no Enterprise voices in my Lync infra.
I would like to know what Lync does exactly when Lync automatic failover while one site goes unexpected down?
will users gets their contacts after moving another site pool?
also
I would like to know what Lync does when we do Lync manual failover while one site goes for maintanence?
Will user gets their contacts after moving another site pool??
Thanks

You need to have the CMS available as it's the repository that stores the topology, configurations and policies. If the pool that hosts the CMS goes down you must failover the CMS before you can failover the pool. Presence information and contacts is not
part of the CMS.
Fail Site B, you'll see that users are in limited mode until you run the pool failover commands even though Site A has the CMS.
More details:
what is the CMS: http://blogs.technet.com/b/jenstr/archive/2010/10/13/what-is-central-management-store-cms.aspx
Pool Failover: http://technet.microsoft.com/en-ca/library/jj204678.aspx
Please mark posts as answers/helpful if it answers your question.
Blog
Lync Validator - Used to assist in the validation and documentation of Lync Server 2013.

Azure Site Recovery vs. Manual Failover?

Hi all-
I am designing a Windows Server 2012 R2 DR scenario using Hyper-V replica.
Environment:
Site A: Primary Server (HP DL380 using DAS with Gen2 / VHDX VMs). System Center VMM 2012 R2 management server and console installed on this Hyper-V host. SQL database for SCVMM placed in one of the VMs on this host.
Site B: Replica Server (Identical HP DL380).
Approximately 10Mbps WAN connection interconnecting the sites.
I need to provide DR for approximately 5-6 VMs. These will be running standard MS apps like SQL, SharePoint, etc.
I am wondering if it's worthwhile to use Azure Site Recovery to orchestrate a small DR scenario like this or whether, due to its small size, I am better off just planning to use manual failover.
Also, if I DO elect to use Azure site recovery, do I need to install the full SCVMM 2012 R2 Server and Console on the server, or will a management agent from the Primary Server do the trick? If a full installation, I'm assuming I will need a full instance
of SQL Server to host a separate database at Site B. Am I correct?
Thanks

Hi,
Azure Site Recovery is awesome, and I will recommend it to all who has a environment that supports it. If all prerequisites is met, it's simple to enable and manage :)
http://msdn.microsoft.com/library/azure/dn469078.aspx (Prerequisites and support)
http://azure.microsoft.com/en-us/documentation/articles/hyper-v-recovery-manager-configure-vault/
You can replicate between two clouds on the same on-site VMM server. So if you place your VMM service so it will not fail if your Hyper-V host does, you should be fine :)
Anyway, if you are fare away from the prerequisites, you might be better of by implementing the built-in Hyper-V Replica service, and the take the step to Azure Site Recovery when you have time.
Best of luck in your project!
/Anders Eide

2 ISP link failover in ASA 5505

Hi,
I have ASA 5505, want to configure the 2 ISP link Tata and Airtel with failover.
I want to configure the WebVPN with failover, so that user don't need to change the public address when one link goes down.
thanks with regards
Ashish Kumar

Hi michael,
First of thanks for reply.
Can we do it by public certificate or DNS entry e.g. both ISP Public ip address entry will be in DNS and user will hit particular DNS name. You r right that once link down so user will disconnect but when he will retry then he will connect via another link.
Is it possible??
Ashish

ASA failover: secondary ASA disabled failover on its own

Hi all
I have a failover pair of ASA 5520 (Software Version 8.2(4)4)
located in two different data centers.
Because of a network issue the layer 2 connection between both locations has been interrupted for a couple of seconds and the ASAs went into split-brain as one would expect them to do.
The thing is that after approx. 1 minute the secondary ASA switched off its failover configuration (i.e. "show run" gives "no failover") without anybody telling it to do so. Here is the "show failover history" of the device:
07:57:34 MESZ Aug 15 2011
Standby Ready              Just Active                HELLO not heard from mate
07:57:34 MESZ Aug 15 2011
Just Active                Active Drain               HELLO not heard from mate
07:57:34 MESZ Aug 15 2011
Active Drain               Active Applying Config     HELLO not heard from mate
07:57:34 MESZ Aug 15 2011
Active Applying Config     Active Config Applied      HELLO not heard from mate
07:57:34 MESZ Aug 15 2011
Active Config Applied      Active                     HELLO not heard from mate
07:58:03 MESZ Aug 15 2011
Active                     Cold Standby               Failover state check
07:58:18 MESZ Aug 15 2011
Cold Standby               Disabled                   HA state progression failed
At this point failover was switched off completely and the split-brain remained even after the layer-2-connection has been reestablished.
This is no good.:( I have searched for "HA state progression failed" without any useful result/explanation.
Why did the device switch off failover on its own and how can we assure that it won't do this again?
Best regards,
Grischa

Yes, only thing I needed to do was issuing "failover" on the secondary. It detected its active mate and went properly into standby:
09:16:18 MESZ Aug 15 2011
Disabled                   Negotiation                Set by the config command
09:16:19 MESZ Aug 15 2011
Negotiation                Cold Standby               Detected an Active mate
09:16:21 MESZ Aug 15 2011
Cold Standby               Sync Config                Detected an Active mate
09:16:31 MESZ Aug 15 2011
Sync Config                Sync File System           Detected an Active mate
09:16:31 MESZ Aug 15 2011
Sync File System           Bulk Sync                  Detected an Active mate
09:16:31 MESZ Aug 15 2011
Bulk Sync                  Standby Ready              Detected an Active mate
I guess we will go the TAC way if we encounter this situation a second time. This time we will be warned and know where to look at.
Is there really no documentation available of the "HA state progression failed" message? What does it mean and how is it triggered usually?
Regards,
Grischa

Manual Failover

          Here is the situation. We have two servers (Server A Production, Server B Failover)
          each running an instance of WebLogic. If Server A, the current production environment
          were to go down what reconfiguration would need to occur for Server B.
          Basically, we want to know what needs to be done to manually convert Server B as
          the production server.


First of all, are these two servers running as part of a WebLogic cluster?
          If so, you do not need to do anything (failover happens automatically). If
          not, what you are describing to me seems to warrant a cluster (to achieve
          automatic failover; you also achieve load-balancing).
          If they are not part of a cluster and you have a WebServer in front of
          Server A, then it is simply a matter of reconfiguring the WebServer to start
          sending requests to Server B instead - you might have to bump the server (I
          am of course assuming that Server B is identical in configuration to Server
          A). Of course, all active sessions will be lost in this case. As I mentioned
          earlier, you might want to seriously consider a cluster if you want failover
          to happen automatically and preserve session state (transparent to the
          user).
          Giri
          "Andrew Van Cleve" <[email protected]> wrote in message
          news:3a7f3123$[email protected]..
          >
          > Here is the situation. We have two servers (Server A Production, Server B
          Failover)
          > each running an instance of WebLogic. If Server A, the current production
          environment
          > were to go down what reconfiguration would need to occur for Server B.
          >
          > Basically, we want to know what needs to be done to manually convert
          Server B as
          > the production server.

LAN Failover in ASA 5505

I have two web server and I want to configure ASA 5505 in such a way that it forward all incoming request to ServerA. In case if ServerA is down or failed ASA 5505 automatically forward all incoming request to ServerB.
I am new to ASA 5505.
Thanks in advance.

You can do that if the web server are in two different subnet. So one web server is on a interface and the other web server is on other interface. You must configure ip sla as below :
interface Ethernet0/0.1239
vlan 1239
nameif OUTSIDE
security-level 0
ip address 94.125.239.251 255.255.255.0
interface Ethernet0/0.1240
vlan 1240
nameif OUTSIDE-BACKUP
security-level 0
ip address 94.138.42.43 255.255.255.248
route OUTSIDE 0.0.0.0 0.0.0.0 94.125.239.252 1 track 1
route OUTSIDE-BACKUP 0.0.0.0 0.0.0.0 94.138.42.41 254
sla monitor 123
type echo protocol ipIcmpEcho 8.8.8.8 interface OUTSIDE
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability
For the web server A if is down, you must check it with a script that is executing on a server in the same subnet of web server A

Manual failover of the Clusterware VIP, crs_relocate versus nodeapps

I would like to prevent incoming connections the 2nd node of a 2 node RAC cluster running 10.2.0.4 on Red Hat 5.5. My concern is, if I shutdown nodeapps on the 2nd node, the node I want to keep incoming connections off of, would that prevent the VIP from failing over to it if something happens to the 1st node? If I used crs_relocate to relocate the 1st VIP to the second node, would the VIP failover back to the 1st node if something occurred to the 2nd node?
I appreciate any insight,
Thank you

IIRC, doing a relocate effectively disables the original node. So, if node1 crashes after you relocated from node2 then you are pretty much down.
http://docs.oracle.com/cd/B19306_01/rac.102/b14197/srvctladmin.htm#i1009833
"The relocated service is temporary until *you* modify the configuration."

Failover Occured manually or automatically (SQL Server AlwayOn with Availability Groups)

Hello everyone,
we had a Failover today on a Windows Server 2012 Failover Cluster with SQL Server Always On and now I'd like to know if the failover was done by the Cluster (or SQL?) or manually from a user...
In the Cluster Log I can see following entry: INFO [RCM] rcm::RcmApi::MoveGroup: (CVGID2, 1, 0, MoveType::Manual )
So I assume that the failover was done by a user... But: I can see only Movetypes of "Manual" in the cluster log of this always on system...
So my question is: Is it possible that since SQL Server (Always On) is kind of "driving" the cluster, that if it makes an automatic failover the Cluster will log this as a "manual" failover because it was not done by the Cluster service
itself?
Thanks for any help!
Ville

Hi Ville,
When we meet this event it indicate it is not an issue since the failover was triggered manually.
The related third party article:
dbi services Blog
http://www.dbi-services.com/index.php/blog/entry/wsfc-manual-or-automatic-failover-that-is-the-question
I’m glad to be of help to you!
*** This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these
sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use
of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet. ***
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Manual failover of ASA

Similar Messages

Maybe you are looking for