Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Upgrading licenses on FWSMs in Failover

 

Introduction

In many cases, we see that network outages are caused while attempting to upgrade the licenses for FWSMs in failover. This is because failover gets disabled due to "License Mismatch" on both the FWSMs and that affects the traffic going through the FWSM.

 

Error Message

The following typical error message is seen in the console logs when a license mismatch is detected among the failover peers:

 

Mate's license (X Contexts) is not compatible with my license (Y Contexts). Failover will be disabled.

 

In the output of "show failover history", the reason for disabling failover will be "Other unit license is different".

 

This document aims at explaining the correct steps to be followed while upgrading Licenses in an Active/Standby or Active/Active failover scenario.

Steps to Upgrade

In the following example, I will be upgrading the context license to 250 on the devices. Before upgrading the licenses, please ensure that failover works properly.

 

Step 1: On the Active device, issue "no failover". This forces the Standby device to be in Pseudo-Standby state, in which it will not pass any traffic. Also, this will prevent the Standby device from trying to become the Active unit when the licenses do not match. If the devices are running in Active/Active failover, run the command "no failover" on the system context. Once you do this, you will see that the Failover is Off on both devices as follows:

 

On the Active device:

 

FWSM-Primary(config)# sh fail

Failover Off

Failover unit Primary

Failover LAN Interface: FAIL-LAN Vlan 50 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 0 of 250 maximum

 

On the Standby device:

 

FWSM-Secondary(config)# sh fail

Failover Off (pseudo-Standby)

Failover unit Secondary

Failover LAN Interface: FAIL-LAN Vlan 50 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 15 seconds

Interface Policy 50%

Monitored Interfaces 0 of 250 maximum

 

Step 2: Enter the activation-key on the Primary. Please ensure that this license is for the Primary device's serial number. In the active/active setup, enter the activation key from the system context.

 

FWSM-Primary(config)# activation-key xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx

 

Once you enter this command, you will see the following:

 

Licensed features for this platform:

Maximum Interfaces          : 1000     

Inside Hosts                : Unlimited

Failover                    : Active/Active

VPN-DES                     : Enabled  

VPN-3DES-AES                : Enabled  

Cut-through Proxy           : Enabled  

Guards                      : Enabled  

URL Filtering               : Enabled  

Security Contexts           : 250      

GTP/GPRS                    : Disabled 

BGP Stub                    : Disabled 

VPN Peers                   : Unlimited

 

Both running and flash activation keys were updated with the requested key.

 

Step 3: Use the command "show version" on the Active unit to check the license. You will see "Security Contexts:250" and the activation key will be what you had entered (look for "Running Activation Key" under "show version").

 

Step 4: Go to the system context of the Standby Unit, and enter the corresponding activation key. Please ensure that this license is for the Standby device's serial number. In the active/active setup, enter the activation key from the system context.

 

FWSM-Secondary(config)# activation-key yyyyyyyy yyyyyyyy yyyyyyyy yyyyyyyy

 

Once you enter this command, you will see the following:

 

Licensed features for this platform:

Maximum Interfaces          : 1000     

Inside Hosts                : Unlimited

Failover                    : Active/Active

VPN-DES                     : Enabled  

VPN-3DES-AES                : Enabled  

Cut-through Proxy           : Enabled  

Guards                      : Enabled  

URL Filtering               : Enabled  

Security Contexts           : 250      

GTP/GPRS                    : Disabled 

BGP Stub                    : Disabled 

VPN Peers                   : Unlimited

 

Both running and flash activation keys were updated with the requested key.

 

Step 4: Use the command "show version" on the Standby to check the license. You will see "Security Contexts:250" and the  activation key will be what you had entered(Look for "Running Activation  Key" under "show version").

 

Step 5: Enable failover on the Active device by issuing the command "failover".In the Active/Active failover setup, enter this command from the system context.

 

This finishes the license upgrade process.

The following FWSM configuration guides now include the upgrading process as a result of the fix for bug CSCts52674:

 

4.0 doc
http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/swcnfg_f.html#wp1075771

4.1 doc
http://www.cisco.com/en/US/docs/security/fwsm/fwsm41/configuration/guide/swcnfg_f.html#wp1073958

 

Note: When an FWSM is replaced, the licenses have to be transferred to the new unit from the old one. After installing the new activation key, you might come across a situation where you see that the licenses don't reflect the actual status-like, say, the number of interfaces may not be what it used to be prior to the replacement. In such cases, please confirm if the module was in multiple context mode earlier. If yes, you will have to convert the new module to multiple context to see the correct licenses.  

2008
Views
0
Helpful
0
Comments