Router HSRP Active/Standby question

Hello,
Can I use following command to setup HSRP Active/Standby mode for both router ?
Router A:
ip address 10.10.228.202 255.255.255.248
standby 3 ip 10.10.228.201
standby 3 preempt
Router B:
ip address 10.10.228.203 255.255.255.248
standby 3 ip 10.10.228.201
standby 3 preempt
standby 3 track 1 decrement 10
standby 3 track 2 decrement 10
Thanks

Wilson,
we don't know what objects you're tracking, so it's a little bit difficult to answer the question.
You use the default priorities on both routers (100), so, as long as track objects 1 and 2 are up, Router B will be the active router, because it has the higher IP address.
If track object 1 or 2 goes down, Router B's priority will be reduced to 90 (or 80 if both are down at the same time),  so Router A will become active, because preemption is enabled.
If the track object(s) change to up, Router B will take over again, because it also has preemtion enabled.
Correction:
Preemption only comes into play when the local priority is higher than the priority of the current active router. In your examle, the priorities on RA and RB have the same values. The IP addresses serve as a tie breaker only in the initial phase, the preemption feature doesn't consider the IP addresses later on.
Consequence: Router A continues beeing the active router.
HTH
Rolf

Similar Messages

  • 6500 Slide Active Standby Question

    My Active Standby is only displaying 1 event whereas my old 6280 displays more than 1. Is it possible for the 6500 Slide to display more than 1?
    Thanks in advance.

    BUMP

  • Active Standby Question

    I have a Nokia E60, which operates using Symbiuan 9.1, series 60 3rd edition. This software lets you put 6 shortcuts on the main screen (active standby). There is an interface to change which shortcuts are used. I want to make a shortcut to the "Installations Directory" so that I will have a fast way to access my installed programs but this directory does not appear on the list of possible shortcuts. Does anyone know if this is possible? If so, how? Thanks,
    Mark

    No can do. Only individual apps seem to work as Active Standby shortcuts, not menu folders.

  • ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    This topic has been beat to death, but I did not see a real answer. Here is configuration:
    1) 2 x ASA 5520, running 8.2
    2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
    3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
    4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
    This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
    Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
    The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
    In any case, any experts out there that can answer question? TIA!

    Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
    Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
    Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
    Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
    Thanks much,
    Mike

  • Active Standby Pair Clustering.

    Hi Chris, I had created ActiveStandby Pair as follows:
    Server 1 => DSN: TTCluster1
    Server 2 => DSN: TTCluster2.
    Then I created ActiveStandby Pair in Server1, Started RepAgent and then Duplicated the DSN on Server 2 with name TTCluster 2. It worked fine.
    Now to access it from the client server mode, I created Client DSN on Client machine using Virtual IP. (Using Linux Cluster Manager).
    But inthis case I had to create two client DSN. TTCluster1Client and TTCluster2client. Since Application can connect to only one DSN and shifting to other while failover is very difficult.
    So I am trying following model now, Let me know your views on this.
    Server 1 and Server 2, both will have same DSN name "TTCluster".
    Client Machin will have only one DSN "TTClusterClient" using VIP.
    When the Server1 failes, Server 2 will take over and there is no need of shifting client DSN. Application will be routed to Server 2 after switch over.
    Step1: created server DSN "TTCluster" on Server 1 and Server 2.
    Step2: created user 'ttcluster' on Server 1 and Server 2.
    Step3: Create DataStore TTCluster on Server 1. (By connecting to TTCluster).
    Step4: Create Cache Groups (AWT) on Server1.
    Step5: Started Cache Agent on Server1.
    Step6: Created ActiveStandby Pair on Server1 as follows:
    CREATE ACTIVE STANDBY PAIR
    TTCluster ON "wabtectimesten.patni.com",
    TTCluster ON "wabtectimesten2.patni.com"
    RETURN TWOSAFE
    STORE TTCluster PORT 20000 TIMEOUT 120;
    Step8: executed ttrepstateset('ACTIVE') on server1.
    Step9: Started Replication Agent on Server1.
    Step10: Duplicated DataStore on Server2.
    Issues:
    Server2 is not coming up as Standby. The log on Server1 shows following messages:
    15:19:33.83 Warn: REP: 8671: TTCLUSTER:receiver.c(1723): TT16060: Failed to read data from the network. select() timed out
    15:19:37.09 Err : REP: 8671: TTCLUSTER:receiver.c(3428): TT16142: Failed to retrieve peer information. No peers found
    15:19:37.09 Err : REP: 8671: TTCLUSTER:transmitter.c(5523): TT16229: Transmitter thread failure due to lack of state consistency at subscriber store _ORACLE
    Question:
    While creating replication scheme I have mentioned.
    STORE TTCluster PORT 20000 TIMEOUT 120;
    I need to define the timeout for both DataStores. How will I do that?
    The above timeout will be applicable for which datastore??
    Can you please let me know if I am going in the right direction???

    Hi Tanweer,
    When designing a monitoring scheme for TimesTen one has to bear a few things in mind (though not all will be relevant in every case):
    1. There could be multiple 'instances' of TimesTen installed on a machine. Each instance is completely independent and must be monitoried separately.
    2. Each instance has a 'main daemon' (timestend) that is the instance master supervisor. If this daemon is running and healthy then the 'instance' is considered to be 'up' and 'healthy'.
    3. Each instance can manage multiple datastores. Each datastore is independent from the others and so each datastore must be monitored separately.
    4. Each datastore may be using replication and/or cache connect. If so, these must also be monitored as well as the datastore since it is perfectly possible e.g. for the datastore to be healthy but for replication to be 'down'.
    Depending on your requirements, your monitoring mechanism must 'model' this structure and relationships...
    - If the instance main daemon is not running, or is not responding, then the entire instance is 'down' and all datastores managed by the instance should also be considered as 'down'
    - If a datastore goes down (e.g. call invalidate), other stores in the instance are not affected and neither is the main daemon for the instance. They will continue to operate normally.
    - A datastore may be healthy in itself but maybe replication or cache connect for the datastore is not healthy. Do you then consider the datastore as down? That depends on your applications requirements!
    Hopefully this helps to clarify the interrelationship of components. Crashing a datastore by calling 'invalidate' does not crash the daemon (if it does then that is a bug!).
    For monitoring the instance (main daemon) there are a few options:
    1. ps -ef | grep timestend. This can detect if the daemon process is running but not if it is healthy...
    2. Connect to a datastore. Every connect/disconnect request is processed via the main daemon so if the daemon is not healthy this will result in some error (usually a 'cannot communicate with the daemon' error). However, connect/disconnect are relatively expensive so you don't want to do this too often.
    3. Have a monitoring process that maintains an open connection to the instance level datastore (DSN=TT_<instancename>). Periodically (as often as required within reason) it can execute the built in procedure ttDataStoreStatus() passing it the pathname of the instaance datastore checkpoint files (obtainable from the built in procedure ttConfiguration). This procedure communicates with the main daemon so will either return success (meaning daemon is okay) or an error (daemon is in big trouble).
    If you have to do the test from a script then I would suggest that (2) is best but if you can do it from a continually running monitoring process then (3) is better.
    For monitoring a datastore the best way to ascertain overall health is as follows:
    1. Have a dummy table in the datastore. And as part of the check update a row in th dummy and commit the transaction. If this returns success then this shows that the datastore is up and able to service update requests (which means it is also okay for read requests).
    2. You should also monitor the available space in the datastore and warn someone or something if the free space gets too low. You can query space allocation, current usage and high watermark usage from the SYS.MONITOR table. You can also configure TimesTen to generate SNMP traps and/or return warnings to applications if space usage exceeds some configured threshold. The objective is to take proactive action to prevent the datastore becoming full since that will require more disruptive corrective action.
    For monitoring replication you should periodically:
    1. Check that the datastore's repagent is running (you can do this using ttDatastoreStatus)
    2. Check the status of each replication peer by calling ttReplicationStatus and checking the values of pstate (should be 'start') logs (if this value increases over time then the peer is in some kind of trouble) and lastMsg (if there is no message from the peer for a long time then it may be in some kind of trouble).
    3. Sometimes an easier way is to have a dummy table set up for synchronous replication and do an update+commit for a row in that table. if replicatioin is working the commit will return within a few ms at most. If you get a timeout error returned that tells you that replication is in trouble,
    To monitor cache connect is not so easy at present.
    For AWT cache groups, the same monitoring as is used for replication is okay).
    For SWT cache groups, if the sync to Oracle is not working every commit will get an error (so that's kind of obvious).
    For AUTOREFRESH cache groups it's a bit harder. There is currenyly no supported way to determine when the last successful autorefresh occurred. I am hoping this capability will be added in a future release.
    Sorry if that is a bit long winded - I hope it helps...
    Chris

  • Cisco ASA Active standby failover problem

    We have configured ASA Active standby failover with ASA5505 . When primary unit power off, secondary unit became active. when primary unit power on, then primary unit is becoming active again. i think for active standby setup there is no preemption. The real issue is when primary ASA became active after power on all the external connectivity getting down. Please see the below config,
    ASA01# show run
    ASA01# show running-config 
    : Saved
    ASA Version 8.2(5) 
    hostname ASA01
    enable password PVSASRJovmamnVkD encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.1.1 MPLS_Router description MPLS_Router 
    name 192.168.2.1 SCADA_Router description SCADA_Router
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
     switchport access vlan 2
    interface Ethernet0/3
    interface Ethernet0/4
     switchport access vlan 3
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.3.8 255.255.255.0 standby 192.168.3.9 
    interface Vlan2
     nameif outside
     security-level 0
     ip address 192.168.1.8 255.255.255.0 standby 192.168.1.9 
    interface Vlan3
     description LAN Failover Interface
    ftp mode passive
    clock timezone AST 3
    access-list inside_access_in extended permit icmp any any 
    access-list inside_access_in extended permit ip any any 
    access-list inside_access_in extended permit ip any host MPLS_Router 
    access-list outside_access_in extended permit icmp any any 
    access-list outside_access_in extended permit ip any any 
    access-list outside_access_in extended permit ip any 192.168.2.0 255.255.255.0 
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    failover
    failover lan unit primary
    failover lan interface FAILOVER Vlan3
    failover key *****
    failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route-map Route_Out permit 1
     match ip address inside_access_in outside_access_in
     match interface inside
    route outside 0.0.0.0 0.0.0.0 MPLS_Router 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.2.0 255.255.255.0 inside
    http authentication-certificate inside
    http authentication-certificate outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.2.0 255.255.255.0 inside
    telnet 192.168.1.0 255.255.255.0 outside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username admin password eY/fQXw7Ure8Qrz7 encrypted
    prompt hostname context 
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1a8e46a787aa78502ffd881ab62d1c31
    : end

    I suggest removing the failover configuration on both units and then re-add them, and then test.
    Primary
    failover lan interface FAILOVER Vlan3
    failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
    failover lan unit primary
    failover key KEY
    failover
    Secondary
    failover lan interface FAILOVER Vlan3
    failover interface ip FAILOVER 10.1.1.1 255.255.255.0 standby 10.1.1.2
    failover lan unit secondary
    failover key KEY
    failover
    Please remember to select a correct answer and rate helpful posts

  • Best practice for ASA Active/Standby failover

    Hi,
    I have configured a pair of Cisco ASA in Active/ Standby mode (see attached). What can be done to allow traffic to go from R1 to R2 via ASA2 when ASA1 inside or outside interface is down?
    Currently this happens only when ASA1 is down (shutdown). Is there any recommended best practice for such network redundancy?  Thanks in advanced!

    Hi Vibhor,
    I test ping from R1 to R2 and ping drop when I shutdown either inside (g1) or outside (g0) interface of the Active ASA. Below is the ASA 'show' failover' and 'show run',
    ASSA1# conf t
    ASSA1(config)# int g1
    ASSA1(config-if)# shut
    ASSA1(config-if)# show failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: FAILOVER GigabitEthernet2 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 60 maximum
    Version: Ours 8.4(2), Mate 8.4(2)
    Last Failover at: 14:20:00 SGT Nov 18 2014
            This host: Primary - Active
                    Active time: 7862 (sec)
                      Interface outside (100.100.100.1): Normal (Monitored)
                      Interface inside (192.168.1.1): Link Down (Monitored)
                      Interface mgmt (10.101.50.100): Normal (Waiting)
            Other host: Secondary - Standby Ready
                    Active time: 0 (sec)
                      Interface outside (100.100.100.2): Normal (Monitored)
                      Interface inside (192.168.1.2): Link Down (Monitored)
                      Interface mgmt (0.0.0.0): Normal (Waiting)
    Stateful Failover Logical Update Statistics
            Link : FAILOVER GigabitEthernet2 (up)
            Stateful Obj    xmit       xerr       rcv        rerr
            General         1053       0          1045       0
            sys cmd         1045       0          1045       0
            up time         0          0          0          0
            RPC services    0          0          0          0
            TCP conn        0          0          0          0
            UDP conn        0          0          0          0
            ARP tbl         2          0          0          0
            Xlate_Timeout   0          0          0          0
            IPv6 ND tbl     0          0          0          0
            VPN IKEv1 SA    0          0          0          0
            VPN IKEv1 P2    0          0          0          0
            VPN IKEv2 SA    0          0          0          0
            VPN IKEv2 P2    0          0          0          0
            VPN CTCP upd    0          0          0          0
            VPN SDI upd     0          0          0          0
            VPN DHCP upd    0          0          0          0
            SIP Session     0          0          0          0
            Route Session   5          0          0          0
            User-Identity   1          0          0          0
            Logical Update Queue Information
                            Cur     Max     Total
            Recv Q:         0       9       1045
            Xmit Q:         0       30      10226
    ASSA1(config-if)#
    ASSA1# sh run
    : Saved
    ASA Version 8.4(2)
    hostname ASSA1
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface GigabitEthernet0
     nameif outside
     security-level 0
     ip address 100.100.100.1 255.255.255.0 standby 100.100.100.2
     ospf message-digest-key 20 md5 *****
     ospf authentication message-digest
    interface GigabitEthernet1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
     ospf message-digest-key 20 md5 *****
     ospf authentication message-digest
    interface GigabitEthernet2
     description LAN/STATE Failover Interface
    interface GigabitEthernet3
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet4
     nameif mgmt
     security-level 0
     ip address 10.101.50.100 255.255.255.0
    interface GigabitEthernet5
     shutdown
     no nameif
     no security-level
     no ip address
    ftp mode passive
    clock timezone SGT 8
    access-list OUTSIDE_ACCESS_IN extended permit icmp any any
    pager lines 24
    logging timestamp
    logging console debugging
    logging monitor debugging
    mtu outside 1500
    mtu inside 1500
    mtu mgmt 1500
    failover
    failover lan unit primary
    failover lan interface FAILOVER GigabitEthernet2
    failover link FAILOVER GigabitEthernet2
    failover interface ip FAILOVER 192.168.99.1 255.255.255.0 standby 192.168.99.2
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-715-100.bin
    no asdm history enable
    arp timeout 14400
    access-group OUTSIDE_ACCESS_IN in interface outside
    router ospf 10
     network 100.100.100.0 255.255.255.0 area 1
     network 192.168.1.0 255.255.255.0 area 0
     area 0 authentication message-digest
     area 1 authentication message-digest
     log-adj-changes
     default-information originate always
    route outside 0.0.0.0 0.0.0.0 100.100.100.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 10.101.50.0 255.255.255.0 mgmt
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 10.101.50.0 255.255.255.0 mgmt
    ssh timeout 5
    console timeout 0
    tls-proxy maximum-session 10000
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    crashinfo save disable
    Cryptochecksum:fafd8a885033aeac12a2f682260f57e9
    : end
    ASSA1#

  • IPS modules in Cisco ASA 5510 Active/Standby pair.

    All, I am looking to add the IPS module to my ASA 5510's. I am contemplating only purchasing one module and placing it in the active ASA. I am willing to accept that in a failure scenario I will loose the IPS functionality until the primary ASA is recovered. I have not had a chance to talk to my SE to see if this is even possible. Has anyone attempted a deployment such as this? Will it work and is it supported?
    Sent from Cisco Technical Support iPad App

    Ok, that is what I needed to know.  The purpose of us having an active/standby ASA is to keep the business up and going for the very rare times there could be an active ASA failure.  The purpose for the IPS would be to help protect and inspect traffic and is not necessary to keep the business running.  If we implement IPS I am not worried at all if during the times when the primary ASA is down (hasn't been down for over three years now) we lose the IPS funcationality.  This is not worth the $1000 extra per year to us.
    Thanks for the responses though.  That answers my questions.

  • Step to prep CSC SSM on ASA Active/Standby mode

    Hi all, 
    I am trying to setup Active/Standby HA mode for my site.
    Currently the site was installed with one unit ASA firewall with CSC-SSM module, the second unit is the new unit ready to be setup.
    My question:
    01. My concern is second unit CSC-SSM, what is the proper procedure or step need to prep it?
    Is it need to prep the CSC-SSM before the ASA in HA mode Or it will auto propagate the configuration when both unit in HA mode?
    What else need to concern? am i need to setup different IP for the CSC-SSM management interface?
    Thanks
    Noel

    Hello Yong,
    Configuration related to the CSC or SSM modules will never get propagated so you will basically need to configure it manually.
    Also it's not like if the Config on both modules is different failover will fail but ofcourse you wanna have the same one
    IP addresses for each of the modules will be dedicated ones. Remember that failover will fail if one box has the CSC and the other not.
    Looking for some Networking Assistance? 
    Contact me directly at [email protected]
    I will fix your problem ASAP.
    Cheers,
    Julio Carvajal Segura
    http://laguiadelnetworking.com

  • ASA failover with 1 AIP SSM in Active/Standby?

    I have a customer with two ASAs; in Active/Standby. They want to purchase one AIP. Will failover (without the AIP functionality) to the Standby work if the AIP is configured for Promiscuous mode? Thanks, Bob

    The only connection to the SSM that can be done internally through the ASA is a "session". This is an internal telnet to the SSM and can be used to access the SSM's CLI.
    This is very usefull when you manage your SSM directly through the CLI.
    However, most customers prefer to use a graphics based tool like IDM, ASDM, or CSM for managing the configuration of the SSM, and prefer to use a graphics based tool like IEV or CS MARS for monitoring of the alerts from the SSM.
    All of these graphics based tools need network access to the SSM through a web port (https on port 443 by default). Access to this port is not allowed internally through the ASA direct to the SSM.
    All web connections must be made to the External Management interface of the SSM.
    If you are not using all 4 of your ASA interfaces you could choose to wire the External SSM interface directly to one of your ASA interfaces, and create a small subnet for the ASA and IPS IP Addresses. So then all external connections to the SSM would be routed into the ASA, then out of the ASA, and into the external port of the SSM.
    That subnet of just the ASA and SSM could be made using a network reserved for local IPs (like a 10, or 172, or 192 network) and then use NAT/PAT for translation on the other network interfaces of the ASA.
    But it does still require that wire connected to the external port of the SSM.

  • How to tell if Active/active or Active/Standby mode is configured?

    Folks:
    I am still learning the output of my running config, but how do I tell if my firewall is set to Actve/Active or Active/Standby mode?
    In addition, how do I tell if it uses regular or stateful failover mode?
    Thank you

    I wanted to provide this as well, since I found it and it also helped me answering my question.
    This output shows Active/Active failover output.
    **Note** it says PIX; however, I beleive it will be the same output for ASA.
    PIX1(config-subif)#show failover
    Failover On
    Cable status: N/A - LAN-based failover enabled
    Failover unit Primary
    Failover LAN Interface: LANFailover Ethernet3 (up)
    Unit Poll frequency 15 seconds, holdtime 45 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 250 maximum
    Version: Ours 7.2(2), Mate 7.2(2)
    Group 1 last failover at: 06:12:45 UTC Apr 16 2007
    Group 2 last failover at: 06:12:43 UTC Apr 16 2007
      This host:    Primary
      Group 1       State:          Active
                    Active time:    359610 (sec)
      Group 2       State:          Standby Ready
                    Active time:    3165 (sec)
                      context1 Interface inside (192.168.1.1): Normal
                      context1 Interface outside (172.16.1.1): Normal
                      context2 Interface inside (192.168.2.2): Normal
                      context2 Interface outside (172.16.2.2): Normal
      Other host:   Secondary
      Group 1       State:          Standby Ready
                    Active time:    0 (sec)
      Group 2       State:          Active
                    Active time:    3900 (sec)
                      context1 Interface inside (192.168.1.2): Normal
                      context1 Interface outside (172.16.1.2): Normal
                      context2 Interface inside (192.168.2.1): Normal
                      context2 Interface outside (172.16.2.1): Normal

  • Stop/start in PGW active/standby mode

    Hi all
    My VOIP Network has 2 PGW in active/standby mode. But when we add more telco, the state of ss7path is OOS. i must stop/start the PGW and ss7path is IS status.
    Now PGW is running services. it processing many call with other telco.
    i have question need to support.
    When we stop/start PGW,has PGW disconnected all call or not?
    Thank for supporting
    PhaiLQ

    If you restart the service on active pgw, calls are disconnected. If you don't want out of services you must pass the control to the standby server first.
    From mml console of active server use the command:
    rtrv-ne    to check the status, the output is:
        MGC-01 - Media Gateway Controller 2010-09-07 16:53:42.655 MEST
    M  RTRV
       "Type:MGC"
       "Hardware platform:sun4u sparc SUNW,Sun-Fire-V240"
       "Vendor:"Cisco Systems, Inc.""
       "Location:MGC-01 - Media Gateway Controller"
       "Version:"9.6(1)""
       "Platform State:ACTIVE" 
    sw-over::confirm to swich control to standby server
    now restart the service
    /etc/init.d/CiscoMGC stop
    /etc/init.d/CiscoMGC start
    P.S. If I remember the right way, the OOS (out of service) state of new ss7 path can be set in IS (in service) via mml command line without service restart.
    set- your ss7 path ::IS   use tab for help
    Regards.

  • Calendar entries in Active Standby mode

    A double question, but both are closely related.
    In Active Standby mode it shows upcoming calendar entries for today and future ones.
    Q1) Can someone clarfify does it only show 1 entry for future events, since I have placed 2 entries for tomorrow and 1 for the day after. But only 1 (the first) appears in Active Standby.
    Q2) I THINK IS A BUG!! It does not show Anniversary as future events in Active Standby. It only appears when it is on the day (bit late if you need to buy a present!).
    Any comments
    Andrew
    Device: N70
    Version: V 2.0536.0.2 12-09-05 RM-84

    I think this is by design. Not quite sure what the basis is of what is included and what is not. Items from the current day seem to show up in greater numbers than in future days.
    All About Symbian - News, reviews and software for S60 phones.

  • Active/Standby Failover with pair of 5510s and redundant L2 links

    Hi
    I just got two ASA5510-SEC-BUN-K9 and I'm wondering is it possible to implement an Active/Standby Failover configuration (Routed mode) with two ASA5510 and redundant pair of switches from both inside and outside interfaces? In other words, I would like to have two L2 links from each ASA (in pair od ASAa) to each L2 switch (in pair of redundant L2 Switches). The configuration I would like to achive is just like one in Cisco Security Appliance Command Line Configuration Guide, page B-23, figure B-8, with only difference that I wouldn't go with multiple security contexts (I want Active/Standby failover).
    Thanks in advance
    Zoran Milenkovic

    Hello Zoran,
    Absolutely. You can have 2 ASAs configured in Active/Standby mode. For reference, here is a link which has a network connectivity diagram based on PIX, however, connectivity would still be same with ASAs-
    http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/failover.html#wp1053462
    The difference is that on ASA, you can only have LAN-Based failover, hence you'll need to use one additional interface on both ASAs for failover-link. You can connect these two failover-link interfaces directly using a cross cable.
    Apart from this, please refer to following link on how to go with configuration of Lan-based Active/Standby failover-
    http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1064158
    Also make sure that both ASAs have required hardware/software/license based on following link-
    http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/failover.html#wp1047269
    Hope this helps.
    Regards,
    Vibhor.

  • Active/Standby failover automatic primary active

    I have 2 ASAs 5510 with same physical configuration and running ok with active/standby failover mode. Like we have PREEMPT command in active/active failover to get back primary active after its been rebooted from failed mode. This command makes primary back to active and makes secondary firewall standby automatically.
    Need help to know any such command for active/standby failover for automatic primary active. Currently we have to use command FAILOVER ACTIVE on primary to make it active manually.

    Remember, failover in ASA works differently than HSRP. ASA does NOT use
    HSRP. Furthermore, there is NO HSRP ip address in ASA either. You are
    talking about two different technologies.
    Think of it this way. HSRP technology works very similar to VRRP and
    Juniper NSRP. All of these technologies use virtual IP address. If you
    have two devices, you will have an Virtual IP address, in addition
    to the physical ip addresses of the two devices. ASA does not use the
    extra VIP.

Maybe you are looking for