Cisco Firewall :: ASA 5520 Cable Based Failover

Oct 2, 2011

What kind of cable is used for failover in asa 5520 ? 

View 11 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5510 - LAN Based Failover Not Working

Jun 23, 2011

I have ASA 5510 connected as shown in attached diagram.Ideally when ASA 1 is active and if I boot Switch-1, ASA-2 shood take over. But that is not happening.When I boot SW1 , ASA-2 shows "Failover LAN Interface: failover Ethernet0/0 (Failed - No Switchover)" and remains standby.Fail over works properly If ASA-1 boots.

View 7 Replies View Related

Cisco Firewall :: 5520 Identity Based Firewall Doesn't Work Using Citric Published

Jul 26, 2012

We are using the newest release of AD Agent (1.0.0.32.1, built 598). The ASA Firewalls 5520 are having the software release 8.4(3)8 installed.When somebody tries to connect thru the Identity based firewalls from a citrix published desktop environment (PDI) the connection is not possible. Checking the ip-of-user mapping on the firewalls (show user-identity ip-of-user USERNAME) mostly doesn't show the mapping of the USERNAME and the PDI the user is logged in. The user-of-ip mapping of the PDIs IP-address shows mostly other users, which then are used to authenticate the acces thru the firewalls.
 
What is interesting, that on the AD Agent using "adacfg.exe cache list | find /i "USERNAME"" i can't see the PDIs IP-address neither because it is mapped to another user.Is Citrix Published Desktop environment supported to connect thru Identity based Firewalls? How AD Agent, Domain Controllers and Firewalls are working together? On the firewalls with "show user-identity ad-agent we see, the following:
 
-Authentication Port: udp/1645
-Accounting Port: udp/1646
-ASA Listening Port: udp/3799
 
Why Cisco does use 1645 and 1646 and not 1812 and 1813?The Listening Port is used for what purpose? we tried the AD Agent modes full- download and on-demand with the same effect.

View 17 Replies View Related

Cisco Firewall :: ASA 5520 With Failover NAT With Two ISP?

Jun 20, 2011

Currently we have one ISP1 and all traffic goes to this way. Suppose our isp1 goes down, our outside user cant get the server. All servers are nated to this ISP1.We planned to purchase a another ISP2. Shall we Configure same inside server to map this ISP2? so that one primary ISP1 goes down it will take place the outside trafficISP2.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Failover With SLA?

Jul 19, 2011

Is it possible to setup 2 x Cisco ASA 5520 that are in an Active/Standby failover using sla monitoring?
 
For example ASA1 outside interface connects to an upstream switch and you setup sla monitor with icmp echo to ping that switch. The switch goes down and you need the other ASA2 to become the Active ASA. Can the sla monitor be automatically integrated with the failover commands for this to happen?

View 5 Replies View Related

Cisco Firewall :: ASA 5520 Failover Did Not Work?

Apr 17, 2011

I am having ASA 5520 with active/standby configured. Around 2 days ago, the ASA stopped responding & all of my websites stopped working. when i checked the failover status it said that failover is off. I had to manually turn the failover to start my traffic flow.During this time my secondary ASA was not responding. After some time, the primary stopped responding & secondary became active......to solve this i had to make the secondary unit as failover unit primary & the primary unit as failover unit secondary. i did get a log on ASA :-
 
“(Primary) Disabling Failover” with error message no.105001 which states the below:-
 
Error Message %PIX|ASA-1-105001: (Primary) Disabling failover.
 
Explanation In version 7.x and later, this message may indicate the following: failover has been automatically disabled because of a mode mismatch (single or multiple), a license mismatch (encryption or context), or a hardware difference (one unit has an IPS SSM installed, and its peer has a CSC SSM installed).(Primary) can also be listed as (Secondary) for the secondary unit.

View 1 Replies View Related

Cisco Firewall :: Cannot Run ASDM After Failover Asa 5520

Nov 24, 2011

I have 2 ASA5520's in failover pair.After failing over I cannot run ADSM on the secondary (now active device), I get "unable to launch device manager from [primary address]"
 
I can ASDM to the primary device (now marked as "standby ready") on the failover address. I can SSH to it also.I CANNOT ASDM to the secondary device (now marked as "active") on the primary address. I CAN SSH to it.
 
When I run "sh asdm image" I get valid output (asdm image disk0:/asdm-645.bin) on both.However when I run "sh ver" on each it appears ASDM is not running on the secondary device :
 
Cisco Adaptive Security Appliance Software Version xxxx [only]
 
Compared with :
 
Cisco Adaptive Security Appliance Software Version xxxx
Device Manager Version 6.4(5)
 
It appears as though ASDM is only running on the primary device (regardless of the fact it is now in standby mode). Is this normal?
I am having to run in a failover condition due to a intermittent hardware fault on the primary unit but require access to the ASDM for monitoring/diag purposes during this condition.

View 2 Replies View Related

Cisco Firewall :: Failover Between ASA 5510 And 5520?

Sep 27, 2012

Cisco still doesn't provide failover (active/standby) between two different types of ASA, right?
 
[URL]
 
"The two units in a failover configuration must have the same hardware configuration. They must be the same model, have the same number and types of interfaces, and the same amount of RAM"

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Failover Pair

Oct 31, 2012

i am trying to setup a failover pair on Cisco asa 5520 - need a state full failover. Do i need two ports dedicated to obtain the above - one for LAN based failover and one for state full fail over ? also do i need a switch in between to connect them ?

View 11 Replies View Related

Cisco Firewall :: ASA 5520 - Configured For Failover

Jan 25, 2012

I have 2 Cisco 5520 ASAs and was configured for Fail over. Unfortunately our Primary ASA went down and Secondary becomes Active and network admin made lots of changes on Secondary Active ASA. What is the best practice to rejoin Primary as standby or active without loosing the existing configuration on Secondary Active ?

View 6 Replies View Related

Cisco Firewall :: 5520 - ASA Failover Pair With Different License

Apr 15, 2013

I have a running ASA5520 in my network and recently we plan to add a failover pair as a standby unit for the running asa. Both of the ASA have the same specs and software. the only thing that the soon to be secondary ASA does not have is the AnyConnect Essential license. is it still possible for the unit to be the standby unit?
 
below is the license capture from both of the unit.
 
Running ASA:
Licensed features for this platform:
Maximum Physical Interfaces  : Unlimited
Maximum VLANs                : 150     

[Code].....

View 3 Replies View Related

Cisco Firewall :: Failover License Sync Between Two ASA 5520?

Jun 3, 2013

According to the link here:[URL]Starting with Version 8.3(1), it no longer needs to install identical licenses. Typically, we only buy a license only for the primary unit; for Active/Standby failover, the secondary unit inherits the primary license when it becomes active.So I wanna know if there's some additional configuration to synchronize the licenses such as SSL VPN or Context between the primary one and the second one? Or they can just synchronize by default as soon as I finish the failover configuration and when the primary one gets down, the second one will take over the role including licenses automatically?

View 4 Replies View Related

Cisco Firewall :: Activation Key For ASA 5520 Failover Pair

Mar 20, 2012

We have recently got 2 of our Cisco ASA 5520 firewalls through RMA. These are supposed to run in a Active/Active Failover Pair. There was only 1 RMA request that was opened for both the firewalls. We have received only 1 Activation key for this RMA request for both the firewalls. Just want to check with you if this Activation key will work on both firewalls or do we need a get a seperate one for the other box.

View 1 Replies View Related

Cisco Firewall :: Failover Transparent Mode ASA 5520?

Sep 19, 2012

Recently, I unable to configure the failover on bridge group in transparent mode . I have five interfaces .out of this only 3 is showing in the show run config . Whether I can config failover on on of the data interfaces.
 
I have the ASA 5520 with the version ASA Version 7.2(4) <context>

View 3 Replies View Related

Cisco Firewall :: 5520 - ASA Phone Proxy After Failover?

Dec 3, 2012

I have a problem with my asa phone proxy. i have two ASA 5520  in HA. I have 10 phone register with ASA active primary. if i execute the command show phone-proxy secure-session. i can see the phone session on the ASA.
 
if i perform the same command on the passive ASA i can't see the session replicated from the active member.
 
If i switch the cluster the phone enter in a registrating loop and can't connect to the ASA now active.
 
If i switch back immediately (the session are still present on the first asa) the phone register again and all works

the ASA have version 8.4(5)

the phone are a 7921g
 
is normal that the skinny don't start again and re-register the phone on the ASA that became active after failover?

View 1 Replies View Related

Cisco Firewall :: Copy Files Between Failover ASA 5520?

Oct 29, 2012

I made an ASDM upgrade for one of my two CISCO ASA 5520. If I copy a file to the primary ASA's flash, is there any command I can  run on the primary ASA to copy a file to the secondary ASA?

View 1 Replies View Related

Cisco Firewall :: Adding New ASA 5520 To Failover Pair

Mar 3, 2011

I have one ASA 5520 up and runnign, with complete configuration (ssl customization, DAP, CSD...) with bunch of files on flash drive, etc. I am using software 8.3Now I received one 5520 that I want to use failover, it is with 8.3, I will make sure that ASDM is also the same on both...
 
So, my question is how to make my running ASA to become primary and to push all info (config, files on flash, etc) to new ASA?
 
I found few examples, but nothing tells me how to force one ASA to be the source for sync.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 8.4 Failover Interface Testing?

Jan 3, 2012

From ASA 5520 we tested the interface failover it not working even the interface are getting monitor . 
 
primary is active.
 
Manually we shut the outside interface of the primary device configuration is getting reflecting in secondary as outside interface shut. Interface failover not happen.
 
ii All the interface are getting monitor when we gave command sh failover. even though when we shut outside interface failove not happening.
  
how to do the interface failover in ASA 8.4 version.

View 3 Replies View Related

Cisco Firewall :: Rebuild ASA 5520 Failover Unit

May 12, 2011

What process I need to follow to rebuild my failover unit? I've had to turn it off because it seems that both the primary and secondary were thinking they should both be the active unit. I'm not sure why. But in turning off the failover, I had internet access again. So I think I want to rebuild the secondary unit's configuration. Do I need to turn off failover from the primary unit first? Disconnect the secondary unit, console into it and remove the configuration (command to remove from flash?)? Rebuild the interfaces..all interfaces or just STATE between the units? Just trying to get a list of the process

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Failover Unit Anyconnect Licenses

Jan 2, 2012

So i setup a failover active / passive with 2 ASA5520's
 
Primary asa has 750 Anyconnect vpn licensing and the secondary asa has 2 Anyconnect licenses     
 
I haven't setup the second asa with the new 750 licenses i purchased but when i do a show version it shows that the failover licensed features shows 750...
 
Does this mean i do not have to install the secondary anyconnect licenses on the standby ASA unit?
 
output of secondary asa
:
Licensed features for this platform:Maximum Physical Interfaces       : Unlimited      perpetualMaximum VLANs                     : 150            perpetualInside Hosts                      : Unlimited      perpetualFailover                          : Active/Active 

[Code]......

View 1 Replies View Related

Cisco Firewall :: Cannot Assign LAN Failover Link As Statefull On ASA 5520

Oct 5, 2011

I was trying to assing statefull link as same as LAN failover link on ASA5520 with VPN Plus license. But i am getting the below error. Is there any restriction in the license itself.

View 1 Replies View Related

Cisco Firewall :: 5520 - Failover ASA LU Allocate Xlate Failed

Oct 10, 2011

we have two ASA 5520, on the failover unit is showing LU allocate xlate failed. We read on [URL] that it could be a memory problem , but have cheked it and we have 85% of memory free on both nodes. We also can see  all xlate on failover unit.
 
We have forced failover this evenig and we can´t stablish outbound connexions by outside interface, we think xlates or nat cant work properly.

View 5 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Failover - IP Addressing?

Mar 15, 2011

I am getting ready to setup avtice/standby failover on our ASA 5520's and have run in to an issue.I currently only have one External IP address available. My Idea was to use a private/placeholder IP address for the standby external IP Address, will this cause any issues with the failover? I know I won't be able to access the secondary from the outside, but that is not an issue.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 - Failover In Off State After Applying New License

Mar 24, 2013

We apply a new anyconnect mobile license to our primary asa 5520 and the failover feature went into an off state. WE have now applied a second purchased anyconnect mobile to our secondary asa but the failover is still inactive/off.
 
bcoh1fw50# sh failover state 
State          Last Failure Reason      Date/Time
This host  -   Primary
Disabled       Ifc Failure              14:43:21 EST Jan 30 2013

[Code].....

View 3 Replies View Related

Cisco Firewall :: 5520 Running 8.4(2) - Setup Active / Standby Failover

Jan 30, 2012

I am trying to setup an active/standby failover with 5520's running 8.4(2) and am having problems with it not dropping connections during the failover. I am using a portchannel from the switch to each ASA and using sub-interfaces off that. I'm using the command Failover mac address Port-Channel1 “mac-address on primary Port-Channel1” “mac-address on standby Port-Channel1”.The command goes through but doing a show interface port-channel1 doesn't show a change in the mac address on the secondary unit after a failover when it becomes active.

View 3 Replies View Related

Cisco Firewall :: ASA 5520 - Interface Reconfiguration In Active / Passive Failover

Dec 20, 2011

Currently l have two ASA 5520's in a active/passive failover scenario.  Currently the interfaces for the inside and outside are fixed at 100/FULL.I want to repatch them into GigE ports setup as Auto Negotiate.Is there anyway of keeping the connections through the firewall active in this type of scenrio or will l have downtime disconnecting and repatching?  or could l possibly disable failover and reconfigure each ?

View 6 Replies View Related

Cisco Firewall :: ASA 5520 Activating Failover Config Drops Routing Table

May 21, 2012

I'm attempting to configure two ASA 5520 for active/standby failover.When I enter the “failover” command to enable the config on the primary ASA, the entire routing table disappears.There is no routing process running, only static routes are configured.
 
Is this an expected behavior of the failover process and if so, how long should I wait for the routes to come back?

View 5 Replies View Related

Cisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure

Mar 30, 2011

I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
 
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
 
IPS soft is 6.0(4) and ASA soft is 8.0(3)
 
I have checked cisco doc and it is confusing to me. it says:  "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..

View 2 Replies View Related

Cisco WAN :: ASA 5520 Failover

May 7, 2013

When I try to put my ASAs in active/standby config here is the error I get.Warning: Failover message decryption failure. Pleas make sure both units have the same failover shared key and crypto license or the system is out of memory.

View 1 Replies View Related

Cisco VPN :: ASA 5520 / Domain Based IPSEC VPN

May 28, 2012

Currently we are having a 2 ISP for Internet. Need to achieve redundancy for IPSEC VPN using the domain.

Requirement :Will configure a domain and assign two public IP address from 2 service providers. Will set the priority for the public ip address and do the manual change during the ISP failure.We will provide the domain name to the clients to setup the IPSEC VPN.So incase of failure by one ISP, we will change the priority in the domain to point to the availble address.So that we can reduce the downtime and no need of configuring new IPSEC VPN tunnels.

Question :Whether we can achieve this in Cisco ASA 5520.Or do we have an alternate solution to overceome this solution.

View 1 Replies View Related

Cisco WAN :: Failover Between ISP Router ASA 5520

Aug 24, 2011

I'd like to configure HA between an ISP router and a firewall ASA like shown in the document. I was thinking about HSRP but can I use HSRP between a router and a firewall?Another information.I have 1 asa 5520 on my site connected to an ISP 1, and a second asa 5520 at a second ISP's datacenter. My aim is that if the 2nd ISP is not available, all trafic go through the asa on site and to the first ISP.

View 4 Replies View Related

Cisco VPN :: ASA 5520 / Remote Access VPN - Allow Based On Ports

Jan 25, 2013

I have Cisco ASA 5520 / ASA Ver: 8.0(4) / ASDM Ver: 6.1(3). I have configured Remote Access VPN and everything seems to be fine. Like i have created Extended ACL and allowed for singe host with particlar port to be allowed.

After login with the Anyconnect client, i am restricted to access the single host configured, but not based on ports. i.e. i do not want user to RDP the server allowed, but only access the application based on the port that is allowed. But somehow it is not working.
 
how can i allow user to access a server with defined port only and not any other service/port access for the server.

View 4 Replies View Related

Cisco WAN :: ASA 5520 - Source IP Based Load Sharing

Jul 25, 2011

A customer has an ASA5520 and 2 ISP routers with one WAN link each, and wants to split the load over both routers based on source IP ("natted" IP on ASA). I found this excellent doc on the topic: {URL}. Using PBR to achieve this is an option I was looking at, but I have come across a possible loop doing this with 2 routers. Setup:

           -----------CE-1---------ISP-1
           |           |
           |           |
ASA55020----      HSRP |
           |           |
           |           |
           -----------CE-2---------ISP-2
 
Both Routers receive default routes via BGP, and customer networks are propagated via BGP as well (i.e. the customer can specify the return path for the traffic). The ASA5520 forwards traffic to a HSRP virtual IP for redundancy purposes. If one router or ISP fails, all the traffic should use the other router/ISP. The customer wants to specify which traffic is sent over which link, by defining nat rules on the ASA. e.g. traffic sourced from the network 10.10.1.0/24 will always use ISP 1, and traffic sourced from the network 10.10.2.0/24 will always use ISP 2.
  
My problem: if I use route-maps on both routers (CE-1 and CE-2), sending part of the traffic to the other, and one ISP link fails, in my opinion I have a loop, since part of the traffic will get sent back to the router it came from. Is there any other was to achieve my goal without using PBR? I have looked at CEF and GLBP, but I cannot seem to find a way to load share via source IP.

View 8 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved