Config: 2 * Cat 6513 (hybrid OS) 7.6(10) / 12.1(22)E5 + 2 * FWM 2.2(1). 1 * FWM per 6513 chassis. FWM in multiple context and failover mode. The state and failover replication is performed over two seperate VLANs / Gb ether channel links between the 6513s.
Issue: On failover, the standby unit becomes active and some connections survive. However, some connections do not survive for which there is an xlate entry. Need to "clear xlate global a.b.c.d" to force the connection to be re-established and then the connection works again. Applies to more than one protocol ie ICMP, TCP etc.
"show failover" on the standby unit shows "Stateful Failover Logical Update Statistics" with receive errors for "Xlate_Timeout", "TCP NPs" and "UDP NPs" (other counters are clean) of about 90%, 0.5% and 26% respectively. The counters are increasing slowly. The TCP and UDP NPs error counts are identical and increment together. The Xlate_Timeout error counter increments independently.
Why do I need to clear xlate? Surely I shouldn't need to do this? The fact I need to clear the xlate implies the xlate got to the standby unit... but maybe it is an old entry that shouldn't be there because the active / standby replication has failed in some way?
If the LU receive errors indicate that the xlates are not being replicated from active to standby unit, does the FWM sort this out by resending or is the update lost and does that explain my different xlate count on the active / standby units?
If I do a "show xlate" on the active and standby units they have a different number of xlates in their tables. Shouldn't these get replicated between the firewalls? Why are the numbers different?
If these are bugs that you have seen before, do you know the Cisco bugID?
Failover should be automatic and there is no need to issue the "Clear xlate" everytime a failover occurs. In fact, this will clear all the existing translations as well.
If you do not see the exact number (or close in case the new xlate is just now made on the primary) of xlates on both active and standby units, then that is a clear indication that replication from active to standby is not happening. I would suggest you to verify your failover configurations.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :