DMZ and Web Server

[Navaz Wattoo]

     i have two cisco ASA 5510 failover firewalls and configured web server in DMZ and the the sh failover is

ACTIVE(config)# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

Unit Poll frequency 1 seconds, holdtime 3 seconds

Interface Poll frequency 3 seconds, holdtime 15 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum

Version: Ours 8.2(5), Mate 8.2(5)

Last Failover at: 09:43:30 PKT Aug 11 2013

        This host: Primary - Active

                Active time: 1357606 (sec)

                slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Up Sys)

                  Interface DMZ (10.1.1.1): Normal (Waiting)

                  Interface Outside (125.209.70.90): Normal (Waiting)

                  Interface inside (192.168.11.249): Normal (Waiting)

                slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Up/Up)

                  IPS, 6.0(6)E4, Up

Other host: Secondary - Failed

                Active time: 0 (sec)

                slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Unknown/Unknown)

                  Interface DMZ (10.1.1.2): No Link (Waiting)

                  Interface Outside (125.209.70.91): Normal

                  Interface inside (192.168.11.250): Normal

                slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Unknown/Unkn

own)

                  IPS, 6.0(6)E4, Unknown

Stateful Failover Logical Update Statistics

        Link : FAILOVER Management0/0 (Failed)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         191867     0          180372     0

        sys cmd         180372     0          180372     0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        737        0          0          0

        UDP conn        603        0          0          0

        ARP tbl         10139      0          0          0

        Xlate_Timeout   0          0          0          0

        IPv6 ND tbl     0          0          0          0

VPN IKE upd     8          0          0          0

        VPN IPSEC upd   8          0          0          0

        VPN CTCP upd    0          0          0          0

        VPN SDI upd     0          0          0          0

        VPN DHCP upd    0          0          0          0

        SIP Session     0          0          0          0

        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       17      180372

        Xmit Q:         0       1486    1553340

ACTIVE(config)#

and when at web server i have installed linux operating system and at web server there are two LAN cards and i bond these LAN card and one path chord is in active firewall and other firewall is passive.

the problems is that when i i put these two cables are in ASA its will not working and when i un plug one cable its working

Navaz       

[Jouni Forss]

Hi,

Can't say I have seen a situation where someone would have directly attached an server into an ASA Failover pair. And that is probably where the problem lies.

I would have to guess that the Failover polling messages are not getting through from one ASA to the other ASA since the only link goes through the PC. I have not tried similiar setup every myself and probably wont

- Jouni

[Navaz Wattoo]

can u chekc my failover configuration is it right?

ACTIVE(config)# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

Unit Poll frequency 1 seconds, holdtime 3 seconds

Interface Poll frequency 3 seconds, holdtime 15 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum

Version: Ours 8.2(5), Mate 8.2(5)

Last Failover at: 09:43:30 PKT Aug 11 2013

        This host: Primary - Active

                Active time: 1357606 (sec)

                slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Up Sys)

                  Interface DMZ (10.1.1.1): Normal (Waiting)

                  Interface Outside (125.209.70.90): Normal (Waiting)

                  Interface inside (192.168.11.249): Normal (Waiting)

                slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Up/Up)

                  IPS, 6.0(6)E4, Up

Other host: Secondary - Failed

                Active time: 0 (sec)

                slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Unknown/Unknown)

                  Interface DMZ (10.1.1.2): No Link (Waiting)

                  Interface Outside (125.209.70.91): Normal

                  Interface inside (192.168.11.250): Normal

                slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Unknown/Unkn

own)

                  IPS, 6.0(6)E4, Unknown

Stateful Failover Logical Update Statistics

        Link : FAILOVER Management0/0 (Failed)

        Stateful Obj    xmit       xerr       rcv        rerr

        General         191867     0          180372     0

        sys cmd         180372     0          180372     0

        up time         0          0          0          0

        RPC services    0          0          0          0

        TCP conn        737        0          0          0

        UDP conn        603        0          0          0

        ARP tbl         10139      0          0          0

        Xlate_Timeout   0          0          0          0

        IPv6 ND tbl     0          0          0          0

VPN IKE upd     8          0          0          0

        VPN IPSEC upd   8          0          0          0

        VPN CTCP upd    0          0          0          0

        VPN SDI upd     0          0          0          0

        VPN DHCP upd    0          0          0          0

        SIP Session     0          0          0          0

        Logical Update Queue Information

                        Cur     Max     Total

        Recv Q:         0       17      180372

        Xmit Q:         0       1486    1553340

ACTIVE(config)#

ACTIVE#   sh failover  state ?

  |  Output modifiers

ACTIVE#   sh failover  state

               State          Last Failure Reason      Date/Time

This host  -   Primary

               Active         None

Other host -   Secondary

               Failed         Ifc Failure              02:44:31 PKT Aug 27 2013

                              DMZ: No Link

====Configuration State===

        Sync Done

====Communication State===

ACTIVE#

Navaz

[Jouni Forss]

Hi,

Actually I was a bit blind.

It seems to me that the actual Failover link between the devices is not UP either.

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

You can check the actual Failover configuration with the command

show run failover

I would also check the actual physical connections as at the moment it seens there are clearly problems with the connectivity between the hosts on certain interfaces.

- Jouni

[Navaz Wattoo]

i connected the failover connection through cross cable

and here i paste the configuration of sh run failover

ACTIVE# sh run failover

failover

failover lan unit primary

failover lan interface FAILOVER Management0/0

failover polltime unit 1 holdtime 3

failover polltime interface 3 holdtime 15

failover key *****

failover link FAILOVER Management0/0

failover interface ip FAILOVER 1.1.1.1 255.0.0.0 standby 1.1.1.2

ACTIVE#

Navaz

[Jouni Forss]

Hi,

So is the interface Management0/0 up/up? Has it been enabled on both ASAs with the "no shutdown" command?

You can use the command "show run interface Management0/0" on both ASA units.

The configurations seems ok.

- Jouni

[garyprice]

How is it possible to use management interface as failover link?

Sent from Cisco Technical Support iPhone App

[Jouni Forss · Accepted solution]

Hi,

In the original ASA5500 Series it was possible. You could also remove the "management-only" setting.

I have not yet tried on the ASA5500-X Series but to my understanding it cant be used in Failover. Also the "management-only" cant be removed.

- Jouni