FWSM Invalid Activation-Key

Answered Question
Jun 28th, 2008
User Badges:

I have to configure Intra-switch FWSM Failover. i configured it but it didnot work. I found that the Activation keys are not valid in show version command. I am sending the configuration i did along with the show version. Is Invalid activation key is the cause of the problem that failover is not working fine

Correct Answer by Syed Iftekhar Ahmed about 9 years 3 weeks ago


These lines should get replicated by just enabling failover lan interface on secondary.

Syed Iftekhar Ahmed

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
cisco24x7 Sun, 06/29/2008 - 06:32
User Badges:
  • Silver, 250 points or more

You need to open a TAC case with Cisco to get

the right Activation key so that it will work

with Failover.

I ran into this issue 2.5 years ago. Even

Cisco TAC was confused by it at first. Things

may be changing now but at the time, to my

knowledge, very few Cisco TAC engineers know

about this limitation.

Syed Iftekhar Ahmed Sun, 06/29/2008 - 23:59
User Badges:
  • Blue, 1500 points or more

This message is very normal. It simply means that no activation keys were entered in FWSM.

If you are using FWSM with standard features (Not using multicontext license needed for more than 2 contexts, or license for GTP inspection) then you will always get this message.

Your secondary FWSM config is not correct.

On secondary yo have to use same ip addresses as you used on primary FWSM failover commands

failover lan interface failover-interface vlan 61

failover interface ip failover-interface standby

failover lan unit secondary


For failover you just need to make sure that you are running same code and same type of licenses (if you are using additional features) on both FWSM.


talha_490 Mon, 06/30/2008 - 04:11
User Badges:

Dear iftikhar,

Thanks for marking the mistake. One more question i would like to ask is that do i need to type the following commands also on the secondary FWSM.

failover link stateful-failover-link vlan 62

failover interface ip stateful-failover-link standby

Correct Answer
Syed Iftekhar Ahmed Mon, 06/30/2008 - 10:34
User Badges:
  • Blue, 1500 points or more


These lines should get replicated by just enabling failover lan interface on secondary.

Syed Iftekhar Ahmed

talha_490 Sat, 07/05/2008 - 04:25
User Badges:

it was working fine with the commands you told but another problem came was the wireless users were not getting the ip addresses from the dhcp server while wired users were getting it and they are both in the same vlan. wireless userss were not able to ping the default gateway.

what could be the reason

Farrukh Haroon Sun, 07/06/2008 - 03:33
User Badges:
  • Red, 2250 points or more

How is your DHCP configured? Are you using 'Super Scopes'?

Make sure you have the latest drivers for your Wireless Cards. This usually happens when the DHCP server is giving the IP /GW from the wrong VLAN.



talha_490 Sun, 07/06/2008 - 03:45
User Badges:

The DHCP server is configured on Windows 2003 server machine and it is located at the outside vlan of the FWSM. the configuration for DHCP is following

dhcprelay server outside

dhcprelay enable Basement_Ground_VLAN

dhcprelay enable Second_Third

dhcprelay enable Fourth_Fifth

dhcprelay enable Sixth_Seventh

dhcprelay enable Eight_Ninth_VLAN

dhcprelay enable DATA-SERVICES

dhcprelay enable Routed_Data_Services_VLAN

dhcprelay enable First_Floor

dhcprelay timeout 60

Wireless users are working with Single FWSM and are getting ip address and as soon as i configured failover they are not getting the ip address however there are wired users who are getting it.

One thing i would also mention that i didnot reload FWSM after configuring it. Should i do a reload.

One more thing that after a long time few users got the ip address but when they renew they were not getting it.

i had cleared arp but even though the problem was same.

srue Mon, 06/30/2008 - 10:36
User Badges:
  • Blue, 1500 points or more

should've bought a checkpoint.


This Discussion