Cisco Firewall :: 5550 - Apply New Startup Configuration To ASA Active Member?

Jun 17, 2012

I have pair of ASA 5550 and I am trying to copy a new config to my member1 (active) as the new configuration I want to use for the pair.  I want to copy this to start-up config on member1 and then reload member1 and have it copy the same config to member2 (stdby).  I guess I am trying to understand if I copy the configuration to member1 and reload it, member 2(stdby) will have become active and try to copy the old configuration to member1 which I do not want. 
get the commands straight that I need to execute to make sure the new startup config gets to both members without being overwritten?


Cisco Firewall :: ASA 5550 Transparent Active / Standby Configuration

Dec 20, 2012

I am in the process of adding a new ASA 5550 as a standby box to an existing ASA 5550 running on transparent mode. Both are on version ASA 8.0(4) and ASDM 6.2(1). I have set the new ASA 5550 to transparent mode. The configurations are the following for the HA: [code]My questions are the following:

1. The management ip address is different than the ip used for the failover link. Since the firewalls are on transparent mode, does the failover ip needs to be the same as the management ip address?
2. Does any other additional config is needed for HA to work for basic active/stand-by failover?
3. Which is the best method to add the second box without disrupting the active box?

View 3 Replies View Related

Cisco Firewall :: ASA 5550 Active / Standby With SSL VPN

Jun 12, 2011

I would like to work with two ASA's 5550 in HA (Acitve-Standby)  like perimetral firewalls and also work with another ASA 5540 but like a SSL VPN Remote Access to end users.Which will be the best topology to this scenary?. Perhaps i need to put the ASA 5540 SSL VPN together with the ASA's in HA directly in a port.

View 1 Replies View Related

Cisco Firewall :: ASA 5550 Lost SSH To Active On Failover?

Dec 19, 2010

I am having a curious problem with two Cisco ASA 5550. They are configured in Active/Standby failover and in routed mode.The problem is: I cannot connect via SSH to the ACTIVE unit, only to the STANDBY. If a switchover is forced the problem is still the same. because it happens both with the primary and the secondary unit.It is not a L2 or a transport problem, because I can ping or access both units via ASDM.

View 8 Replies View Related

Cisco Firewall :: ASA 5550 - Active Port Availability

Sep 28, 2011

with the 5550 we get 4 gig ports on slot 0 and 8 gig ports on slot 1, also a fast Ethernet management interface port. The documentation states that only 8 ports can be active at any one time but does that exclude this management port so that I can use this as well ?
Also is the port assignments for slot 1 like g1/0 - 1/7 ? As the other the 8 ports in slot 1 are 4 x gig E and 4 x gig sfp.

View 4 Replies View Related

Cisco Firewall :: ASA 5510 Configuration Modifications In Active / Active Mode

Dec 17, 2012

I have two ASA 5510s running in Active/Active mode. I need to make config changes on them. How do I go about it? Do I power off the secondary ASA and make the config changes on the primary and then power on the secondary ASA ? Or this another way to do this?

View 3 Replies View Related

Cisco Firewall :: ASA 5550 - Failover Is Not Replicating Configuration

Nov 11, 2012

I discover an issue with my CISCO ASA 5550 because I'm looking at the vlans that I have configured and some vlans on the Stand by device had not an IP address configured, checking the configuration of the failover

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Active / Standby Configuration?

Sep 21, 2011

i have 2 ASA 5505 running 8.3(1) and ASDM 6.3(1).
the first unit is currently working, and i now wish to configure the second unit as standby. im configuring through the ASDM GUI. Started the HA Wizard, choose Active/Standby configuration and enter the IP of the peer device. checks come back all ok. On the LAN link configuration page (step 3of6) Interface is pre selected as VLAN99, I give it a logical name as iface_fail, and enter as primary address and as standby, subnet as, and select port Ethernet0/5
Note that if i click on the buttons next to the IP fields, i get IP addresses of remote hosts!.

View 1 Replies View Related

Cisco Firewall :: 5510 - ASA Active / Standby Configuration

Jun 4, 2012

I currently have a LAN-based failover setup between two 5510s. The failover link is a crossover cable. In the current setup, if I unplug the crossover cable both units become active. From what I understood from Cisco documentation, each unit should mark the failover interface as down and there shouldn't be any failover. That's exactly how I want this setup to work.

View 5 Replies View Related

Cisco Firewall :: 5540 - Active / Standby ASA Failover Configuration Changes?

May 15, 2011

I have 2 ASA 5540s ver 8.3 in Active/Standby state.I am considering a future hypothetical situation where I might need to rename interfaces or reallocate redundant interface groups.  Doing so obviously has a major impact on the current primary configuration.  My goal would be to minimize or eliminate network downtime during the interface changes.
I am wondering if it is possible to force the secondary ASA from the standby to active state.Then temporarily disable failover on the primary unit.Make the interface changes on the primary unit Then reactivate failover on the primary unit Force the primary unit back to active and secondary unit to standby My new interface configuration would then sync from the primary to the secondary.
I believe this would work but must ensure that the secondary ASA can function as the active unit while the failover is disabled on the primary unit.  Is there a set length of time the secondary unit can remain active without a failover peer?
see issues with operating the secondary unit in this manner while making changes to the primary unit?

View 1 Replies View Related

Cisco Firewall :: 6500 Setup In Active / Standby Fail Over Configuration

Feb 29, 2012

I have been having an annoying issue for the past few weeks with my ASA setup. We are using the ASA as our Remote Access Gateway and originally had it setup in a Active/Standby failover configuration using 2 x 5520 ASA's.The original setup of the devices was that the 2 x ASA were setup in a failover configuration, with both of them connecting back to the internal network via a 6500 device. Because of using failover I created a VLAN on the 6500 and put the two ports that connect the ASA's into that VLAN. I then configured the VLAN interface to be the EIGRP interface for the neighbour relationship to the ASA's.
The problem I am seeing is that the EIGRP neighbour relationship between the Active ASA and the 6500 keeps flapping. It occurs abour 4-5 times every day at randmon intervals. Sometimes the neighbour relationship will stay up for 6-7 hours, other times it flaps every 1-2 hours. I initially thought it was due to the failover configuration so I removed one of the ASA's and removed all of the failover configuration, but the EIGRP neighbour flapping problem still exisits. [code] Since removing the failvoer configuration I am thinking it could be a physical cable problem?

View 4 Replies View Related

Cisco Firewall :: 5510 Setup In Active / Standby Failover Configuration

May 8, 2012

We have 2 ASA 5510's setup in an active, standby failover configuration. When the primary fails over to standby, the 3rd party cert does not failover to the standby ASA. The users then receive the CERT missing, invalid message and have to select yes, no to move on. This does not occur when the primary is not in failover mode. It is my understanding that failover fails over certs but in our case it does not apper to be working correctly.

View 1 Replies View Related

Cisco Firewall :: ASA 5520s From Active / Standby To Active / Active

Jul 17, 2012

I have a pair of ASA 5520s operating in failover pair as active/standby, having two contexts on them. I am planning to share the load and make it active/active making first context active on the primary unit and second context active on the secondary unit. My question is if this will disrupt any connectivity thru these firewalls when I do "no failover" on the active/standby and assign the contexts to different failover groups and enable the failover back.

View 6 Replies View Related

Cisco WAN :: 881 Default Ip Configuration For Startup

Nov 19, 2012

don't have an option to connect a console cable to my cisco router.  The usb to serial converter will not work in windows7 only on XP.have physical access to my 881 Cisco Router.  If I remember correctly these routers have a default ip address.   This router is brand new, out of the box.  I am thinking I can access it with the correct IP via network instead of console.

View 7 Replies View Related

Cisco Switching/Routing :: 850 Not Saving Startup Configuration

Jan 18, 2012

I have a Cisco 850 router that whas having problems getting an ip address via DHCP. I did some stuff on it but that didn't work, so I rebooted the router to go back to my last saved startup config. When I turned it back on and connected t othe CLI console I got the "Would you like to enter the initial configuration dialogue?" message. Thinikng I just forgot to save anything to the startup config I went through the initial set up again and made sure to save everything to the startup config. After going through the intial config and setting up a vlan to assign DHCP to clients I saved the config and rebooted, upon reboot and connecting to the CLI console I got the same "Would you like to enter the initial configuration dialogue?" message. Tryign the setup once more and making sure everything was saved to startup config I rebooted again just to make sure the changes would stick, and sure enough they didn't. Whay is the config not saving to the startup config? 

View 3 Replies View Related

Cisco :: LMS 3.2 / RME 4.3.1 - Netconfig Job Not Saving Running Configuration To Startup?

Feb 3, 2013

I'm running LMS3.2 and RME 4.3.1. I deployed a netconfig job to our network which consisted of approximately 800 devices.The report said that the job completed successfully however some of the devices didn't save thier running config to startup.

Is it possible to add a command or issue another netconfig job just to save the running config, so I can identify if the job fails on some devices? Using the tick box in the netconfig job doesn't seem to alert you if its not successful.

View 2 Replies View Related

Cisco :: Copy Running Configuration To Startup - Ciscoworks LMS 4

Mar 21, 2012

We were having a discussion in my group about startup vs running configs, and how often some network managers forget to "click save" when they configure a switch.  Is there a way to configure Ciscoworks to copy the running config to the startup? 

View 2 Replies View Related

Unable To Clear Startup Configuration / NVRAM

Aug 14, 2012

I was working on a Cisco 2600 series router earlier today running IOS 12.4. I ran into an issue where I could not clear the startup-config. I tried:

router#erase startup-config
router#erase nvram


each time IP addresses and things got cleared but other aspects did not which should have been. In the nvram there were several files:

Directory of nvram:/
126 -rw- 2143 <no date> startup-config
127 ---- 5 <no date> private-config
128 -rw- 2143 <no date> underlying-config
1 ---- 49 <no date> persistent-data
2 -rw- 0 <no date> ifIndex-table

View 1 Replies View Related

Cisco VPN :: ASA5505 - Bad Cryptochecksum Ignored And Setting Default Startup Configuration

Jan 9, 2012

There are two issues which are testing my resolve.
1) Bad Cryptochecksum Ignored error
2) Unable to boot to a save startup-config file.
I want to take the configuration from one ASA 5505 and move it to another ASA 5505. I copied the startup-config file from an ASA 5505 running asa821-k8.bin to an ASA running 8.222-k8 to flash using tftp. I set the boot config parameter on the new asa to flash:/startup-config which is the location of the startup file. If I use copy run start command, I over write the startup file. When I copy the startup configuration to the running configuration I get a Bad Cryptochecksum Ignored error and the startup file does not copy over to the running file. How can I resolve this issue?

View 1 Replies View Related

Cisco Switching/Routing :: Restore 881-SEC-K9 Factory Startup Configuration?

May 21, 2012

I messed up  the IOS on the flash of CISCO881-SEC-K9. On reboot it booted to ROMMON which allowed me to tftp up a working IOS c880data-universalk9-mz.151-4.M3.bin. Unfortunately somewhere in my playing around the default startup configuration factory loaded on the routerhas been erased. I can load a new a config on the device but as I'm using the router to learn its useful to have the original config load when I factory reset the device. What is the factory start up config?

View 3 Replies View Related

Cisco Switching/Routing :: 5548 - Removed Fex Still Showing Up In Startup-configuration

Jun 12, 2013

I have reconfigured the FEX numbers attached to a Nexus 5548 running on NXOS5.2  If I do show running-config the interfaces are not there anymore.  But if I do show startup-config the old Fex interfaces still shows up.  I did try write erase then saved the running-config and its still there.

View 1 Replies View Related

Cisco Firewall :: ASA 5585X Active / Active Failover Group Inter Routing

Mar 20, 2012

I am looking at deploying a pair of 5585X's in an active/active multiple context state.  I am creating Mulitple contexts that need to be able to route to each other.  I was going to deploy a type of Gateway context that has a shared interface to all of the other contexts, instead of sharing interfaces directly between the contexts, i beleive this will work as basically i am just cascadng the contexts and sharing interfaces.
The main problem i have come across, is that if i deploy active/active across two appliances using 2 failover groups i can not see a way to route between them, for example. 
I have Context 1, Context 2 and Context GW A including the shared interfaces of Con1 and Con2  in failover group 1 on appliance A with the respective standbys on Appliance 2. I have Context 2, Context 4 and Context GW B including the shared interfaces of Con 3 and Con 4 in failover group 2 on appliance B with the respective standbys on Appliance 1.
I need to be able to route traffic between Context GW A and GW B so that the contexts can communicate in normal operation and in failover.  I do not beleive that I can share an interface between contexts in two separate failover groups and to be honest without adding a L3 device between the appliances i am not sure if this is possible.

View 9 Replies View Related

Cisco Firewall :: ASA5520 - Active / Active Failover In Multiple Security Contexts With Dual ISP?

Jun 1, 2011

I have an ASA5520 in location A with an ISP connection and a matching ASA5520 in location B with a separate ISP connection. We have fiber connecting the two locations and vlans passing back and forth so I will be able to configure the failover via a vlan as well as extend the ISP's to each location via vlans. The Active/Active configuration with the multiple security contexts does not seem to be an issue but how is a redundant ISP configured in this mode?We want to have context A using the ASA in location A with ISP1 as the primary and failing over to ISP 2 in locaiton B We also want to have context B using the ASA in location B with ISP 2 as the primary and failing over to ISP1 in location A Would route tracking provide the desired result? Is there a better option?

View 1 Replies View Related

Cisco Firewall :: 5515x Apply On Firewall / Switches To Make Implementation Successful

Apr 22, 2013

I will be implementing a new firewall (cisco asa 5515x) on my existing  3750x (server switches) and my 2960s (user switches). What should I need to apply on my firewall and swtiches to make the  implementation successfull.  I will put my 3750x as my DMZ and my 2960s  as my inside.  The 3750x have multiple subnet and also the 2960s.which  features and technologies i need to know on those 3 products.  my 3750x  and 2960s don't have any ACL defined and most common features are vlan,  switchport, trunking, spanning-tree, stacking,  my asa knows that my 3750x/2960s have multiple vlans.  my current  connection right now on 3750x and 2960s is just through 6 ports i  assigned as one trunk, below is my config [code]

my  2960s vlans are almost the same with my 3750x except vlan 160, 170,  192.  but of course when i put this in asa, i have to segragate vlan for  3750x (192, 100, 110,160, 170) and 2960s (130, 150).  for my 2960s  connection to the asa and since this will have big bandwidth, i will use  3 ports on my asa (and trunk it) connecting to my 2960s and i will use 2  ports on my asa (and trunk it) connecting to my 3750x.  the one  internet ports and my one management ports on my asa will stay like  that.

View 2 Replies View Related

Cisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure

Mar 30, 2011

I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
IPS soft is 6.0(4) and ASA soft is 8.0(3)
I have checked cisco doc and it is confusing to me. it says:  "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..

View 2 Replies View Related

Cisco Firewall :: ASA5585-X Active / Active Failover Using Etherchannel?

Dec 27, 2011

its possible to set up active/active failover using etherchannel on 5585s? 

View 1 Replies View Related

Cisco Switching/Routing :: Force Catalyst 2960 To Ignore Startup Configuration?

Feb 4, 2013

I was wondering if I can force catalyst 2960 to skip startup config stored in NVRAM and boot with no config everytime it is powered. I tried to find it on google and in cisco white papers but still no luck. I found only commands that begin with "set boot config-register ... ", but switch acts like it does not know these commands.

View 7 Replies View Related

Cisco Switching/Routing :: Copy Startup Configuration From 877W To Another 870 Series Router?

Jan 4, 2012

I have an 877W router that I would like to have a 2nd pre-configured backup for. I was thinking of getting another 870 series (probably an 877) router, as the more expensive wireless option is not actually required. Am I right to assume that I could simply copy the contents of my current config.txt file onto the second router?

View 4 Replies View Related

Cisco Firewall :: How To Configure ASA5520 For Active / Active

Mar 17, 2013

How to Configure ASA5520 for Active/Active

View 8 Replies View Related

Cisco VPN :: Remote Access VPN Configuration On ASA 5550 Version 8.2

Oct 29, 2012

I have a problem relating to remote access VPN configuration on Cisco ASA 5550 verion 8.2(1). I used Cisco VPN client with a simple topology : laptop(client) -----( Internet) ------- (IP public) ASA. Now, I can ping from laptop to OUTSIDE Interface on ASA from Internet when I connect from Cisco VPN client to ASA , I was notified log on Cisco VPN client as below: [code]

View 1 Replies View Related

Cisco Firewall :: 5520 Why Does Dynamic Policy NAT Rule Apply

Jun 4, 2013

we have a nat exemption rule for to w.x.y.z followed by some static nat rules and then dynamic policy nat rule for to w.x.y.z natting to IP a.b.c.d.When I do a packet trace from to w.x.y.z, it shows the packet first matching against the nat exemption rule, and then immediately afterwards it matches the dynamic policy NAT rule. The static nat rules are being successfully bypassed (which is what I want), but why does the dynamic policy nat rule apply if an exempt rule has been hit already? An actual test between the IPs above reflects the result of the packet tracer as well (IP a.b.c.d is seen on server w.x.y.z).We are running the following software on an ASA5520.

View 7 Replies View Related

Cisco Firewall :: 5505 - How To Apply Policing On ASAs With Leased Lines

Jul 2, 2012

I'm trying to configure policing and/or shaping on a setup of 2 x ASA 5505 Sec Plus. The units are placed in office A and office B and each have a ISP connection to the internet and a leased line with a capacity of 4/4 Mbit/s for interoffice communication.
On each ASA there's four subnets. VLAN 200 is used to connect the offices through the leased line.
Outside = 2
Data = 10
Voice = 100
Linknet = 200
I've read a lot of articles and posts about shaping and policing on the ASA but still can't get it to work like I wan't to. I'm trying to limit all traffic besides IP-telephony traffic to 3 Mbit/s and thus reserving 900 Kbit/s for voice traffic. I tried setting a service-policy on the linknet interface on each ASA and set Traffic match to Any traffic and QoS settings for both input and output.
I can see traffic passing the policy when I run the "show service-policy police" command but it never seems to be high enough to be policed which is strange since the ASDM monitoring shows that I'm pushing 3900 kbit/s. I file transfers verifies that policing does'nt work.

View 2 Replies View Related

Cisco Firewall :: 5550 Firewall Set Up For Redundant Purpose

Mar 3, 2011

i two 5550 firewall set up for redundance purpose . in failover we define two different ip add one for primary and one for secondary .interface Ethernet0/0 nameif outside security-level 0 ip address xxxx. standby xxxx.0.0.2!interface Ethernet1/0 nameif inside security-level 100 ip address standby gateway for host will be (primary fw address) however in case of failover , the secondary fw will be up with ip address that was assigned for primary .in this case the secondary ip add is actually nerver used? similarly do i need to have two public ip address for outside (one for primary and one for secondary )   ? or in case if primary fails the secondary comes onlie and take the ip of primary fw . hence i only need to purchase just one ip address.

View 6 Replies View Related

Cisco Firewall :: 5550 Firewall Syslog Message

Feb 22, 2013

I have cisco 5550 Firewall, one messages appear in syslog server from Firewall, (warning) i want to stop this message from appearing syslog traps.

View 2 Replies View Related

Cisco Firewall :: Secondary ASA 5550 Firewall Getting Down Automatically?

Apr 17, 2011

I am having two ASA 5550 firewall running in active/standby mode. With in last two months our secondary firewall got down automatically 3 times. Firewall is running with IOS version 7.1.2. how to proceed further troubleshooting because there are not any logs on firewall.

View 3 Replies View Related

Cisco Firewall :: ASA 5005 Default Account For Login Startup Wizard

Dec 16, 2012

I am running the Startup Wizard from my browser as I do not have a Console Access for a brand new CISCO ASA and I am stucked with the User? Password ? I tried many combination and nothing worked.

View 1 Replies View Related

Cisco VPN :: Configuring Two ASA 5520s In Active / Standby Configuration?

Feb 12, 2012

I'm working on configuring two ASA 5520's in an Active/Standby configuration.  I've got almost everything the same between the two units for AnyConnect to work expect the following two items:

     AnyConnect Client Profiles
     AnyConnect Client Software
If I upload the software manually to the Standby unit I get warning about them not being in sync and on the active unit if I do a 'write standby' it does not copy the profile or software.

View 2 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 Configuration With Windows 2003 Active Directory?

Apr 22, 2011

i have installed system (Windows Server 2003) and i have configure Active directory for testing and configure one user under it ( TEST01)now on the same machine i have installed Cisco ACS 4.2.i'm trying to Authenticate (TEST01) using ACS but it's not working, i can't even see the logs under EVENTVIWER.  simple and easy to configure since both AD and ACS is on the same machine.

View 4 Replies View Related

Cisco Switching/Routing :: 15.0 VSS Dual Active Detection Configuration

Jun 24, 2012

In IOS verson 12.X there was a Bidirectional Forwarding Detection configuration however in IOS 15.0 this isn't available at least not with the same syntax. Is this feature not available in 15.0?
In 12.X this was the syntax of the command:switch virtual domain <number>.

View 1 Replies View Related

Cisco Firewall :: ASA 5550 Two ACL From Outside To Inside

May 13, 2011

I have  ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server ( that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL  rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?

View 7 Replies View Related

Cisco Firewall :: ASA 5550 With IOS 8.0(2) Crashes

Jan 31, 2012

we had just installed our ASA 5550 with IOS 8.0(2) a couple of week ago.
2 interfaces from each slot are being used ie 0/0 for Branch users comming via MPLS cloud ,  0/1 for internal LAN users comming form Core Switch  & 1/0 for Server farm LAN   , 1/1  for Internet (outside)
the first 3 interface are considered inside with sec set at 100   while the 1/1 is outside with sec at 0.
Last night it suddenly started dropping all connections without any warning  or any noticible log form the ASDM logging.
the connection drop would happen for 2 - 3 minutes and would work fine for the next 15 minutes or so..
after conencting the console , we found out that the IOS would suddelny go abrupt and show this display ...
TP-ASA(config)# TP-ASA(config)# TP-ASA(config)# Thread Name: Dispatch UnitPage fault: Address not mapped    vector 0x0000000e       edi 0x24d184b0       esi 0x0000000d       ebp 0x1c6ceaf8       esp 0x1c6ceae0       ebx 0x09e965e0       edx


View 2 Replies View Related

Cisco Firewall :: 5550 - How To Do NAT Exemption With V8.4

Oct 4, 2011

I have looked in the books I have (Cisco ASA, PIX and FWSM; ASA 8.0) and googled a good bit but can't seem to find any specific mention of how to do NAT exemption with v8.4. It seems NAT exemption (NAT 0 access-list) was deprecated. Using ASDM, there's no corresponding menu item for this that is obvious.
We have public addresses inside the ASA and want to allow in/outbound connections using these IP's without NAT. The ASA is a 5550.

View 7 Replies View Related