Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA HA Setup in ACTIVE - ACTIVE State

I have two ASA 5540s, with 8.4.(2).8 installed in a HA setup , they lost synchronisation last week, and now are both in ACTIVE mode.

 

I have a PRIMARY/ACTIVE and a SECONDARY/ACTIVE.

 

Is there any procedure to get back to PRIMARY/ACTIVE and SECONDARY/STANDBY available, is it just rebooting the PRIMARY, and the PRECEDENCE command on it starts the process.

 

Checked Layer 2 / 3 CONNECTION between both devices on the FAILOVER cable, and it is working.

 

 

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Hi,If the both the ASA

Hi,

If the both the ASA devices in Active/Standby HA pair are showing Active , it would be because of the communication issues on the fail-over lan link.

Are the Fail-over interface connected directly between the devices or is there a switch in between ?

Try to check the communication which would be tricky as the IP's would be active IP on both the devices.

You can try to reload the Secondary Unit and it should detect the Primary Active and will become Standby given that the fail-over lan interface communication is working fine.

Also , would you be able to give the outputs for these form both the units:-

show failover history

show fail state

Thanks and Regards,

Vibhor Amrodia

8 REPLIES
Cisco Employee

Hi,If the both the ASA

Hi,

If the both the ASA devices in Active/Standby HA pair are showing Active , it would be because of the communication issues on the fail-over lan link.

Are the Fail-over interface connected directly between the devices or is there a switch in between ?

Try to check the communication which would be tricky as the IP's would be active IP on both the devices.

You can try to reload the Secondary Unit and it should detect the Primary Active and will become Standby given that the fail-over lan interface communication is working fine.

Also , would you be able to give the outputs for these form both the units:-

show failover history

show fail state

Thanks and Regards,

Vibhor Amrodia

VIP Green

I don't think the issue is

I don't think the issue is because the failover link is down.  If the failover link is down a stateful failover would not be possible but since the ASA sends hello messages out active (monitored) interfaces, if there is communication between the ASA data interfaces a failover would not occur and the ASAs would remain in Active/Standby mode. The failover link would be marked as failed.

If both ASAs are in Active Active state I would think that suggests a bigger communication failure between the ASAs.

Are the ASAs located within the same datasenter / communications room or are they seperated?

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
Cisco Employee

Hi Marius,I am not sure if i

Hi Marius,

I am not sure if i understand your reply correctly.

I pointed out that :- If the both the ASA devices in Active/Standby HA pair are showing Active , it would be because of the communication issues on the fail-over lan link.

By this , I was pointing to the failover lan connection between the TWO devices.

Thanks and Regards,

Vibhor Amrodia

VIP Green

Yes, I know.  But when the

Yes, I know.  But when the failover link is down, the ASA sends hello packets out the monitored interfaces (ie. interfaces that are used to send data).  If the primary ASA is reachable through the data interfaces the secondary ASA will remain in standby but the failover link will be marked as failed.

If the primary ASA is not reachable over the failover link or the data links then a failover occurs and the standby assumes the active state.  However, if neither the primary or secondary are able to contact eachother but there is no real failover situation on the primary, you run into a split-brain situation where both become active.

--

Please remember to rate and select a correct answer
New Member

Thanks for the reply Lads,   

Thanks for the reply Lads,

 

 

      Each FW is connected to individual switches, that are connected to each other by fibre link. Checked the Layer2 connections, and you can see the MACs on both devices from  both switches ..

 

       The failed Firewall I put into NO FAILOVER, and can ping either side of the FAILOVER / HEARTBEAT link from the other firewall.

 

      Rebooted the FW with all Interfaces in SHUTDOWN, to check errors on bootup, any issues with failed Firewall, seem to come up correctly

   

      So at the moment, I have a SECONDARY firewall in ACTIVE , and PRIMARY in NO FAILOVER, with interfaces in SHUTDOWN.

 

        Need to bring PRIMARY live again, and system back to PRI / ACTIVE and SECONDARY / STANDBY

 

 

VIP Green

Have you checked the logs for

Have you checked the logs for any abnormalities during the time of the failure?

Since both are in Active, there must have been some type of communication failure between the two ASAs.  Either over the network (perhaps there were som major delays) or one of the ASAs experienced an issue that caused hello packets to not be sent or recieved.

--

Please remember to select a correct answer and rate helpful posts

--

Please remember to rate and select a correct answer
New Member

Marius       Nothing in the

Marius

 

 

     Nothing in the logs of the SECONDARY / ACTIVE , and by the time I had physical access to the PRIMARY/ACTIVE (1 week), nothing in its logs either ..

Looking to bring the system live again next week, have some downtime scheduled ... anyone got a general schedule for systems in ACTIVE-ACTIVE, to PRI/ACT and SEC/STBY?

New Member

Don,t know who said this

Don,t know who said this question was "answered" ... its not

 

 

357
Views
0
Helpful
8
Replies
CreatePlease login to create content