Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

FWSM 2.2(1) - failover & xlate issue

Config: 2 * Cat 6513 (hybrid OS) 7.6(10) / 12.1(22)E5 + 2 * FWM 2.2(1). 1 * FWM per 6513 chassis. FWM in multiple context and failover mode. The state and failover replication is performed over two seperate VLANs / Gb ether channel links between the 6513s.

Issue: On failover, the standby unit becomes active and some connections survive. However, some connections do not survive for which there is an xlate entry. Need to "clear xlate global a.b.c.d" to force the connection to be re-established and then the connection works again. Applies to more than one protocol ie ICMP, TCP etc.

"show failover" on the standby unit shows "Stateful Failover Logical Update Statistics" with receive errors for "Xlate_Timeout", "TCP NPs" and "UDP NPs" (other counters are clean) of about 90%, 0.5% and 26% respectively. The counters are increasing slowly. The TCP and UDP NPs error counts are identical and increment together. The Xlate_Timeout error counter increments independently.


Why do I need to clear xlate? Surely I shouldn't need to do this? The fact I need to clear the xlate implies the xlate got to the standby unit... but maybe it is an old entry that shouldn't be there because the active / standby replication has failed in some way?

If the LU receive errors indicate that the xlates are not being replicated from active to standby unit, does the FWM sort this out by resending or is the update lost and does that explain my different xlate count on the active / standby units?

If I do a "show xlate" on the active and standby units they have a different number of xlates in their tables. Shouldn't these get replicated between the firewalls? Why are the numbers different?

If these are bugs that you have seen before, do you know the Cisco bugID?

Thanks, Dave.


Re: FWSM 2.2(1) - failover & xlate issue

Failover should be automatic and there is no need to issue the "Clear xlate" everytime a failover occurs. In fact, this will clear all the existing translations as well.

If you do not see the exact number (or close in case the new xlate is just now made on the primary) of xlates on both active and standby units, then that is a clear indication that replication from active to standby is not happening. I would suggest you to verify your failover configurations.

Re: FWSM 2.2(1) - failover & xlate issue

I agree that FWSM failover does not require 'cle xla' in order to enable the new active blade to resume firewalling function.

Typical failover test is to use ping@icmp where you should see only a few timeout during switchover processes.

Maybe you could post your fwsm config here to allow us to see the config.

So far, I do not have any issues with my FWSMs (2.2(1)) running on redundant Cat6513.



CreatePlease login to create content