Two ASA Firewalls - only one works

Unanswered Question

We have two ASA 5510 devices. Both configured exactly the same. One is working, the other isn't. We plug ASA (2) in to the network and unplug ASA (1) and we can ping internally, and to our DMZ, but we can't browse to the web. We go back to ASA (1) and all is fine.

Any suggestions? NB: We are not using anything as fancy as Failover - just manually unplugging one and plugging the other one in.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
rahmant Wed, 04/02/2008 - 03:15
User Badges:

What/Who are you using for an Internet connection? Some broadband ISP's here in the US cache + restrict the MAC address of a customer firewall/router to ensure that only 1 device gets Internet service.

rahmant Wed, 04/02/2008 - 03:35
User Badges:

Can you ping out to the Internet from ASA(2) when it's plugged in?


Thanks. I have tried pinging google and various other sites, with no luck.

However, on our test firewall (2) we have managed to get to the outside world, by entering this into the config:

global (outside) 1 interface

So, we can now browse the web, but only if we bypass our proxy server. If we try to go through the proxy, it still fails. But we are making progress!

srue Fri, 04/04/2008 - 10:47
User Badges:
  • Blue, 1500 points or more

are you making sure all the arp caches everywhere are flushing out? i always manually flush all the directly connected devices' arp caches when i change out firewalls. it takes too long for arp tables to update otherwise.

Hi. We tried again today. No luck. I cleared arp on the proxy server, flushed DNS as well. Still nothing. As I said, we can web browse if we bypass proxy. We can't go through the proxy or get our exchange server to talk to the outside world. Both these servers are mapped in the firewall config with internal and external ip addresses.

vijay.t Wed, 04/30/2008 - 05:30
User Badges:


Are you connecting the Internet link directly on the ASA or it is behind the Router .

I think its an ARP issue.try to clear the ARO cache of the Router


This Discussion