I've configured my two ASA 5510s for failover. But it just won't start to work. I cannot pint the failover interface for the other ASA from either one. I've tried connecting the failover ports with straight-through as well as crossover cables. At no time have I been able to get the slightest sign of any connectivity over the faiolveer ports. I can ping all other IPs from each ASA... each one can ping the inside, outside, and management interface of the other.
Is this another special Cisco-only cable? Special pinout? Some further config that's necessary? The TAC isn't of much use... they say my config is fine and that I need to "ensure physical connectivity", but go mute when I ask them precisely how I should do that ;-)
ntasa01# sh failover Failover On Failover unit Primary Failover LAN Interface: failover Ethernet0/3 (up) Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 15 seconds Interface Policy 1 Monitored Interfaces 3 of 250 maximum Version: Ours 7.0(6), Mate 7.0(6) Last Failover at: 07:57:39 PDT May 24 2007 This host: Primary - Active Active time: 255225 (sec) slot 0: ASA5510 hw/sw rev (2.0/7.0(6)) status (Up Sys) slot 1: empty Interface management (10.12.14.253): Normal (Waiting) Interface outside (168.143.121.4): Normal Interface inside (10.15.30.1): Normal Other host: Secondary - Standby Ready Active time: 81899 (sec) slot 0: ASA5510 hw/sw rev (2.0/7.0(6)) status (Up Sys) slot 1: empty Interface management (0.0.0.0): Normal (Waiting) Interface outside (168.143.121.5): Normal Interface inside (10.15.30.2): Normal
Logical Update Queue Information Cur Max Total Recv Q: 0 2 16 Xmit Q: 0 2 150
But:
ntasa01# sh failover state ====My State=== Primary | Active | ====Other State=== Secondary | Standby | ====Configuration State=== Sync Done ====Communication State=== Mac set =========Failed Reason============== My Fail Reason: Other Fail Reason: Comm Failure
And I can no longer ping or telnet to the management interface on the secondary unit ntasa02 I can ping e0/0 and e0/1 on it, so it isn't dead.
Thanks for getting me on the right track... you're more useful than Cisco! :-)
Not exactly , but let clear things a little bit here.
You have to see your failover kit as a single unit with a single configuration, The only difference in the configuration is the failover lines. The unit with the line "failover lan unit primary" becomes the Primary unit and always stays the Primary unit. Primary is a physicall identification of the unit. Same thing applies for the "failover lan unit secondary" .The unit with this line is the Secondary unit and always stays the Secondary unit. What may jump from one unit to the other is the failover state, Active or Standby. So the Primary may be in the Active state or in the Stanby state.
And when you configure an ip address on an interface of a failover kit, the first address is always the Active address and the standby address, well the Standby address. So the ip addresses are not linked to a physical unit, they will jump from one unit to the other each time a failover occurs. So you can't say that this address is the address of my secondary unit , without first verifying in what state is your secondary unit.
Usually the normal way to configure a failover kit is first to configure the primary , then on the secondary, you only configure the failover lines and do a no shut on the failover interface. Then you hook-up the two units and the secondary will get it's configuration from the primary.
In your case , you configured both unit before the failover. So when the configuration synchronisation occured , the secondary configuration was replaced by the primary (wich was the active unit. The active unit config always prevail). So if you look at the ip address of your management interface on the Active unit , you have "ip address 10.12.14.253 255.255.255.0" meaning that there is no stanby address.
So when the synchronisation occured , your secondary unit got rid of it's ip address
That's why your failover is in a Failed state , your management interfaces can't communicate
And when i say to replace your address by
you must do this on your Active unit , and then do a wr mem to synchronise your changes with the Standby. If you made this change only on the Standby unit it didn't accomplish anyhting.
After that you will be able to manage both unit through the management interface if you want, but normally you wouldn't need that. Because if you do a change on the Standby unit it will not be saved, and you will have a message saying your configuration is not synchronised.
Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here.
All logos and trade names are the property of their respective owners.