Cisco Firewall :: ASA 5585 Cannot Connect To Context Active In Failover Group 2

Nov 7, 2011

I am setting up a new pair of ASA 5585's in a multi-context, active/active failover design.  I cannot create management SSH connection to the contexts that are assigned to failover group 2.  With all the security contexts that are assigned to failover group 1 I can SSH to the inside interface IP and login without a problem.  When I try to do that to the group 2 contexts there is no response from the firewall at all, PuTTY just times out.
 
My firewalls are running version 8.2(4).  The contexts seem to be functioning normally in all other respects.

View 5 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5585X Active / Active Failover Group Inter Routing

Mar 20, 2012

I am looking at deploying a pair of 5585X's in an active/active multiple context state.  I am creating Mulitple contexts that need to be able to route to each other.  I was going to deploy a type of Gateway context that has a shared interface to all of the other contexts, instead of sharing interfaces directly between the contexts, i beleive this will work as basically i am just cascadng the contexts and sharing interfaces.
 
The main problem i have come across, is that if i deploy active/active across two appliances using 2 failover groups i can not see a way to route between them, for example. 
 
I have Context 1, Context 2 and Context GW A including the shared interfaces of Con1 and Con2  in failover group 1 on appliance A with the respective standbys on Appliance 2. I have Context 2, Context 4 and Context GW B including the shared interfaces of Con 3 and Con 4 in failover group 2 on appliance B with the respective standbys on Appliance 1.
 
I need to be able to route traffic between Context GW A and GW B so that the contexts can communicate in normal operation and in failover.  I do not beleive that I can share an interface between contexts in two separate failover groups and to be honest without adding a L3 device between the appliances i am not sure if this is possible.

View 9 Replies View Related

Cisco Firewall :: CPU Usage Per Context On ASA 5585?

Jul 3, 2012

I am currently working with ASA 5585 with several contexts. What is the percentage of the CPU used per context. I already have the opportunity to do it for the whole ASA (context admin) using the SNMP mib CISCO-PROCES but, unfortunalty, this mib doesn't allow us to know the percentage of used CPU per context.
 
I was able to know the number of core used per context but not the percentage of the CPU used.

View 6 Replies View Related

Cisco Firewall :: ASA 5585 Multiple Context Licensing

Apr 27, 2011

I am looking to deploy a cloud/borderless network solution and cannot get my head around how the licenses (AnyConnect Mobile and essentials) will be applied in a multiple context deployment. Any correct documentation.

View 1 Replies View Related

Cisco Firewall :: 5585 - BVI Doesn't Show Up In Multi Context ASA

May 7, 2013

I have an ASA 5585 in transparent mode, multi-context. It seems that the option to configure a BVI in one of the traffic contexts isn't there. In other words, while I see the option to configure a bridge group interface in the admin context, no such option comes up in the traffic context.
[CODE]....

View 1 Replies View Related

Cisco Firewall :: 5585 / Have Context In Transparent And Routed Mode?

Apr 24, 2012

Is it possible to have context in transperant mode and routed mode. Means if i need three context then 2 of them is in routed mode and one of them is in transperant mode. If yes then how, i can 't find this info in cisco website.?I am havin 5585-x and asa version 8.4?

View 8 Replies View Related

Cisco Firewall :: How Many Default Virtual Context Counts With ASA 5585 Series

Feb 13, 2012

I prepare replace FWSM to ASA 5585 Series,but I confuse the default virtual context counts on ASA 5585.I used 3 virtual contexts on my old FWSM(1 admin context with 2 contexts).According the ASA configuration guide below. url...
 
It state the ASA 5585 have default 2 contexts,Does it state the ASA 5585 just have 2 contexts or  1 admin context plus "2" context (3 contexts available)

View 4 Replies View Related

Cisco Firewall :: ASA 5585 HA Failover?

Sep 24, 2012

I have a pair of ASA 5585 configured with 2 contexts, C1 & C2, C1 is active on ASA-1 & C2 is active on ASA-2 i did failover test, ping was initiated to host residing behind ASA-1 in context C1 i  powered of ASA-1 then both context became active on ASA-2, however during this failover.i saw 4 ping packets drop..

View 3 Replies View Related

Cisco Firewall :: ASA5520 - Active / Active Failover In Multiple Security Contexts With Dual ISP?

Jun 1, 2011

I have an ASA5520 in location A with an ISP connection and a matching ASA5520 in location B with a separate ISP connection. We have fiber connecting the two locations and vlans passing back and forth so I will be able to configure the failover via a vlan as well as extend the ISP's to each location via vlans. The Active/Active configuration with the multiple security contexts does not seem to be an issue but how is a redundant ISP configured in this mode?We want to have context A using the ASA in location A with ISP1 as the primary and failing over to ISP 2 in locaiton B We also want to have context B using the ASA in location B with ISP 2 as the primary and failing over to ISP1 in location A Would route tracking provide the desired result? Is there a better option?

View 1 Replies View Related

Cisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure

Mar 30, 2011

I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
 
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
 
IPS soft is 6.0(4) and ASA soft is 8.0(3)
 
I have checked cisco doc and it is confusing to me. it says:  "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..

View 2 Replies View Related

Cisco Firewall :: ASA5585-X Active / Active Failover Using Etherchannel?

Dec 27, 2011

its possible to set up active/active failover using etherchannel on 5585s? 

View 1 Replies View Related

Cisco Firewall :: 5585 - Two Different Subnets Assigned To Single Bridge Group

Apr 9, 2013

We are deploying two Cisco 5585 in transparent mode and multiple contexts. they are running Active-Active fail over.
 
There are a lot of V LANs need to be added in the contexts, we are trying to use least contexts to fulfill.
 
ASA supports 8 bridge groups for each contexts, and maximum 4 interfaces for each bridge group.
 
We have assigned four interfaces in different V LANs , set two of them as a pair with one IP sub net and the other two interfaces are in another IP sub net.
 
For example :
 
Bridge group 1:
 
inside1  and  outside1    ------->   192.168.1.0/24
inside2  and  outside2    ------->   192.168.2.0/24
 
However, we can only make one sub net(V LAN pairs ) work when the BVI is set to that IP sub net. If the BVI set to  192.168.1.0/24, the inside1 and outside1, the other pair not work. If the BVI set 192.168.2.0/24, then only inside2 and outside2 work. 
 
Since the BVI can only be assigned to either of the sub net, Is it possible to make both vlan pairs work ? Or we only can have one sub net in one bridge group ?

View 1 Replies View Related

Cisco Firewall :: How To Find Which Context Group Physical Interface Gi0 / 2 Belongs

May 2, 2013

ASA  have two context groups say admin and and x. Its interface gi0/2  has 6 subinterfaces  from 1 to 6.3 subinterfaces ----0/2.1 to 3 are in admin and last 3 are in context x.when i went to system context  it does not show where interface gi0/2 belongs to it only shows up up.how can i find which context group physical interface gi0/2 belongs?

View 4 Replies View Related

Cisco Firewall :: Multiple Context Active / Standby (ASA 5520)

Mar 8, 2013

I need to configure multiple context mode with active/standby failover solution.
 
Even after reading some Cisco documents I still can't understand if active/standby failover configuration has to be done within the admin context only or also within every single context (context-1, context-2 for example). In this case I have to allocate as failover interface a subinterface for each context (admin, context-1, context-2), right ?
 
Therefore a I have an other question: within the admin context, in a failover solution, do I have to allocate all interfaces I want to be moniotred, even though some will be used by context-1 only context and some others will be used by context-2 only context ?
 
An other question is: if active/standby failover configuration has to be done within each context, can I set regular failover within context-1 while stateful failover within context-2 ?
 
The last question is: can I use management interface within all 3 contexts ?

View 8 Replies View Related

Cisco Firewall :: ASA-SM Failover Pair In 6500 - Same Mgmt VLAN In All Context

Jun 19, 2012

I have ASA-SM failover pair in two Catalyst 6500 switches. I send from switch to ASA-SM management VLAN 1234 to admin context for management purposes. I have another 3 contexts on ASA-SM. Can I have same managemenet VLAN1234 on each ASA-SM context? Can it work?

View 1 Replies View Related

Cisco Firewall :: Group Failover Happening Automatically On ASA 8.0.5 23

Nov 6, 2012

We are having ASA 5550 running on 8.0(5)23 IOS. We are having 2 failover groups group1 & group2. currently all contexts are on group1 & its active & Group2 is in BulkSync mode but from last 2 days the failover for group 2 is happning, i am not able to find anything in logs. Its happing daily from 2 days.

View 4 Replies View Related

Cisco Firewall :: Failover ASA 5580 Unsync With Active

Feb 19, 2012

I have encountered a problem in one of customer that the Active ASA 5580 is unable to sync with Standby Failover ASA. When Active is connected with FO and push the configs to it will not find the ethernet/Gig interfaces due to which the all the configuration were not applied and when the primary ASA the secondary is unable to respond.
 
When i attached console with the Standby ASA i have seen this error.
 
Number of interfaces on Active and Standby are not consistent.If the problem persists, you should disable and re-enable failover on the Standby.
 
For detail undestanding i am attaching the configs of primary and standby ASA. The KHI-DR-ASA-BB-01 is the standyby firewall.

View 2 Replies View Related

Cisco Firewall :: ASA 5550 Lost SSH To Active On Failover?

Dec 19, 2010

I am having a curious problem with two Cisco ASA 5550. They are configured in Active/Standby failover and in routed mode.The problem is: I cannot connect via SSH to the ACTIVE unit, only to the STANDBY. If a switchover is forced the problem is still the same. because it happens both with the primary and the secondary unit.It is not a L2 or a transport problem, because I can ping or access both units via ASDM.

View 8 Replies View Related

Cisco Firewall :: 5580 Failover Active And Standby

Dec 21, 2011

I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.

View 5 Replies View Related

Cisco Firewall :: ASA 5510 Active And Standby Failover

Apr 18, 2012

i read that you need only one L-ASA5510-SEC-PL for setting up a Active/Standby Failover. I installed the license on the 1st ASA and tried to setup the failover via the ASDM wizard. It always fails, because the 2nd device can't have a 'base' license.So does this mean, i really need another license?

View 5 Replies View Related

Cisco Firewall :: Adding Failover To Active ASA 5510?

Oct 14, 2012

I am adding a failover asa to an a firewall that is already in production. They are both 5510's, they both have the same abount of ram, have the same code versions. Will there be any downtime while adding the secondary in?

View 2 Replies View Related

Cisco Firewall :: ASA5510 Active / Standby Failover Speed

May 11, 2011

I have just finished setting up two ASA5510s in Active/Standby Staeful failover, using the Management interface for both failover and state. Everything appears to be working well.Configurations were transferred and the "sh failover" on both accurately reports their status before and after a failing the active device.I monitored the inside IP with a continuous ping (using a Windows client) and noticed that there were usually two to three ping responses lost. Is this normal?

View 1 Replies View Related

Cisco Firewall :: 5510 / Setup Snmpv3 With Active Failover?

Apr 1, 2012

What I am attempting to do is setup snmpv3 on two failover 5510's .The problem I am running into, the snmp management software rejects one of the devices as it sees it as having a duplicate engine ID since the two devices share the same config.  Would like to know how this would work in an active/active setup being able to poll both devices.

View 2 Replies View Related

Cisco Firewall :: ASA 5540 - Active / Standby Failover Pair

Apr 13, 2011

I currently have two 5540's in an Active/Standby pair. The primary unit failed on February 12th, so the secondary ASA is now the active one. My question is this - we have made a lot of changes since February 12th and I am planning on fixing this failover issue over the weekend. Will the secondary (now active) FW sync it's config to the non-active FW, or will the failed FW sync it's out-of-date config - removing any changes that we've made in the last month or so.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Failover - IP Addressing?

Mar 15, 2011

I am getting ready to setup avtice/standby failover on our ASA 5520's and have run in to an issue.I currently only have one External IP address available. My Idea was to use a private/placeholder IP address for the standby external IP Address, will this cause any issues with the failover? I know I won't be able to access the secondary from the outside, but that is not an issue.

View 2 Replies View Related

Cisco Firewall :: Can Two ASA 5510 With Different Modules Be In Active Failover Design

Oct 23, 2012

understanding clear about new Cisco ASA 5515-x, 5525-x.I know that this device supports IPS which is included to this appliance without any additional modules.But can this box support IPS and content-filering (Cisco ASA CX or so..) in the same time.
 
 The problem also in next. Can two ASA 5510 with diffrent modules (in one AIP-SSM and in other CSC-SSM) be in active/active failover design?

View 3 Replies View Related

Cisco Firewall :: 5540 - Active / Standby ASA Failover Configuration Changes?

May 15, 2011

I have 2 ASA 5540s ver 8.3 in Active/Standby state.I am considering a future hypothetical situation where I might need to rename interfaces or reallocate redundant interface groups.  Doing so obviously has a major impact on the current primary configuration.  My goal would be to minimize or eliminate network downtime during the interface changes.
 
I am wondering if it is possible to force the secondary ASA from the standby to active state.Then temporarily disable failover on the primary unit.Make the interface changes on the primary unit Then reactivate failover on the primary unit Force the primary unit back to active and secondary unit to standby My new interface configuration would then sync from the primary to the secondary.
 
I believe this would work but must ensure that the secondary ASA can function as the active unit while the failover is disabled on the primary unit.  Is there a set length of time the secondary unit can remain active without a failover peer?
 
see issues with operating the secondary unit in this manner while making changes to the primary unit?

View 1 Replies View Related

Cisco Firewall :: 5510 Active / Standby Failover Errors

Jan 25, 2012

I just added a new 5510 failover unit to an existing 5510 and when connecting my new outside interface on an Active/Standby firewall pair, i get errors messages (red x) on each port scan (monitor & syslog) although the error message indicate all ports are good...additionally the firewalls flip between active and standby non stop. I remove the new standby unit outside interface from a shared switch and everything clears up.

View 1 Replies View Related

Cisco Firewall :: To Setup ASA 5525 In Active Standby Failover Mode

Feb 12, 2013

I need to setup an ASA 5525 in Active/Standby failover mode. I am setting up the ASA for a company that purchased only one public IP address. The public IP address is assigned to the outside interface. My question is will failover work correctly if I don't use a secondary IP address on the failover configuration on the outside interface?

View 4 Replies View Related

Cisco Firewall :: 5520 Running 8.4(2) - Setup Active / Standby Failover

Jan 30, 2012

I am trying to setup an active/standby failover with 5520's running 8.4(2) and am having problems with it not dropping connections during the failover. I am using a portchannel from the switch to each ASA and using sub-interfaces off that. I'm using the command Failover mac address Port-Channel1 “mac-address on primary Port-Channel1” “mac-address on standby Port-Channel1”.The command goes through but doing a show interface port-channel1 doesn't show a change in the mac address on the secondary unit after a failover when it becomes active.

View 3 Replies View Related

Cisco Firewall :: Error Message When Failover From Standby To Active In ASA5585

Aug 14, 2011

I have two ASA in failover with Active/standby configuration. When I switch from standby to active from the standby ASA I get a lot (like 100) of error messages like these below: [code] The failover works fine and nothing seems to be wrong with the firewalls function.

-Hardware is ASA5585-SSP-10.
-Software version: ASA 8.2(5),

ASA is in multiple mode with 17 active context. Why these error messages appear and what they mean?

View 2 Replies View Related

Cisco Firewall :: 5510 Setup In Active / Standby Failover Configuration

May 8, 2012

We have 2 ASA 5510's setup in an active, standby failover configuration. When the primary fails over to standby, the 3rd party cert does not failover to the standby ASA. The users then receive the CERT missing, invalid message and have to select yes, no to move on. This does not occur when the primary is not in failover mode. It is my understanding that failover fails over certs but in our case it does not apper to be working correctly.

View 1 Replies View Related

Cisco Firewall :: ASA 5520 - Interface Reconfiguration In Active / Passive Failover

Dec 20, 2011

Currently l have two ASA 5520's in a active/passive failover scenario.  Currently the interfaces for the inside and outside are fixed at 100/FULL.I want to repatch them into GigE ports setup as Auto Negotiate.Is there anyway of keeping the connections through the firewall active in this type of scenrio or will l have downtime disconnecting and repatching?  or could l possibly disable failover and reconfigure each ?

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved