Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA failover link over the etherchannel connected switches

Hello,

 

 

We have two ASA firewalls located in different locations.

Firewalls are in Active/Standby modes.

Failover links of firewalls are connected to two different switches.

These switches are connected to each other with two dark fibers aggregated to Etherchannel (source-mac address mode)

When one of fiber links fails and then immediately is connected again, secondary ASA is going to Active state and then to Standy state again.

Please see the output bellow.

The holddown timer is set to 15 seconds.

 

What could be the cause of this state change?

 

 

 

ciscoasa# sh failover history 
==========================================================================
From State                 To State                   Reason
==========================================================================
22:54:20 GET Apr 4 2014
Standby Ready              Just Active                HELLO not heard from mate

22:54:20 GET Apr 4 2014
Just Active                Active Drain               HELLO not heard from mate

22:54:20 GET Apr 4 2014
Active Drain               Active Applying Config     HELLO not heard from mate

22:54:20 GET Apr 4 2014
Active Applying Config     Active Config Applied      HELLO not heard from mate

22:54:20 GET Apr 4 2014
Active Config Applied      Active                     HELLO not heard from mate

22:54:42 GET Apr 4 2014
Active                     Cold Standby               Failover state check

22:54:43 GET Apr 4 2014
Cold Standby               Sync Config                Failover state check

22:55:36 GET Apr 4 2014
Sync Config                Sync File System           Failover state check

22:55:36 GET Apr 4 2014
Sync File System           Bulk Sync                  Failover state check

22:55:51 GET Apr 4 2014
Bulk Sync                  Standby Ready              Failover state check

  • Security Management
2 REPLIES
New Member

Maybe spanning tree

Maybe spanning tree recalculation.  I know you said there was an etherchannel but I would make sure it is built properly.  Also run "Show spanning-tree detail" on the switches after you unplug/replug and check when the last topology change was.
 

New Member

Hi, The Ethercannel is

Hi,

 

The Ethercannel is configured properly. 

The topology change event takes place when standby ASA goes to Active state, Line protocol on switch interfaces connected to ASA go to down and then to up state again. 

268
Views
0
Helpful
2
Replies