ASA · TROUBLESHOOTING

Troubleshoot ASA: a pair with two active units

ASA1 and ASA2 were set up as a failover pair, but each one says it is active, and ASA2 never copied ASA1’s configuration. The failover link runs through switch SWF. There are three faults, and show failover names one at a time: fix it, and read show failover again.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switches · 5 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On ASA2, read show failover: the failover LAN interface is Failed - No Switchover, this host is Active, and the mate is Unknown. The last line gives the reason.
No mate answers through SWF. On SWF, show vlan brief, then put both failover ports in the same VLAN, 10.
Now both units say they are primary. Make ASA2 the secondary: failover lan unit secondary.
Now the failover keys differ. Give ASA2 the key ASA1 uses: failover key LABKEY.
show failover on both: one unit is Active and the other Standby Ready, ASA2 holds ASA1’s interfaces, and PC1 reaches 198.51.100.1.

Start this lab

Before you start

A unit that can’t hear its mate assumes the mate is dead and goes active, so any fault on the failover link gives two active units. Work from the cable up: the link and its switch VLAN, then the two unit roles, then the key, then the failover addresses. While they are apart, ASA2 accepts configuration; once it is the standby it refuses, and copies ASA1.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.