Is there a way to trigger stateful (or stateless) failover on ASA 55xx (8.0.3) when there's a failure on the IPS unit? I understand the fail open/fail close and its application on a single firewall, but the better solution for an IPS failure in a redundant pair would seem to be a stateful failover to the other ASA, and I don't see that as a documented feature.
View 8 RepliesI need to add memory to my ASA 55xx's (running 8.2(2)), some of which are config'd active/active or active/standby. The docs say that ram must be identical, which makes sense for production. My question is this: can I upgrade the standby units first, make them active, and then upgrade their mate? Or must I schedule downtime to take the pair down for the upgrade?
View 4 Replies View RelatedI have a remote site with 2 WAN links.Link 1 MPLS with telecom provider managing the PE and advertising EIGRP routes to my switch(3750-E stack).Link 2 Directly connected to core site switch (4506) and advertising EIGRP routes.
It looks like this:
-------- Provider MPLS Cloud ------- GI2/0/1Remote Site (3750-E Stack)
Core Site Switch(4506)----
gi4/2------------------------------------------------ GI1/0/1Remote Site (3750-E Stack)
When both links are up MPLS is disrupted from other sites (that have MPLS only) to the core site. I was unable to get a route list to see what exactly was going on before shutting the directly connected link down.What i'd like to have is:Use MPLS as my primary link as it is fully meshed with all my remote sites (and not just the core) and have the directly connected link as my failover in case of issues with the primary. I assumed putting a delay 1000 on the directly connected link at the remote site would have been enough but it looks like both were active and leaking routes all over the place Is there a way to set this up that the MPLS link is favoured and if it loses routes to that specific remote site it would failover to the directly connected link?
Here is my current configuration for EIGRP on the remote and Core sites:
Remote 3750-E
router eigrp 100
redistribute connected
redistribute static
passive-interface default
no passive-interface GigabitEthernet1/0/1
[code]....
What is the equivalent oid as chassisid - .1.3.6.1.4.1.9.3.6.3.0, which gets the serial number for most cisco switches/routers is for the ASA 55XX series firewalls.
View 2 Replies View RelatedWe are testing the AnyConnect VPN Client to replace legacy IPSec VPN Client 5.0.x. We could setup the connections with SSL and IPSec (IKE v2).Now we have to decide which ist the better method.
View 1 Replies View RelatedI've seen a lot of things I want to and need to fix to get our network more secure but my first order of business is Visio diagrams of the old network and projected diagrams of the new network when we move to our new DC next Saturday. I've made maybe 1 diagram on my own thus far and have edited a few. I want to create physical and logical diagrams but I'm not quite sure what to include and what not to include on either since I haven't seen a wealth of diagrams up to this point in my career.
1st question: Does anyone know where I can get visio stencils of IPS modules for ASA 55xx series? Didn't see them on Cisco's stencil site or with a google search
2nd question: Our network is setup like this... A stack of 3 3750s act as our "Core" and have a 2 port etherchannel to every layer 2 2960 switch (15) in the network. In a physical diagram, 30 links would make it a little busy, hell even 15 links represented as the etherchannels would be busy
I am in process of replacing our 44xx controllers with new 55xx controllers. During the upgrade, I would like to add redundancy to our guest controllers that reside in the DMZ and had a question about regarding the setup.
If I remember correctly, I would place both guest controllers on the same mobilty group, and then add both of the controllers to the foreign controllers. The foreign controllers will form mobility with both anchors, but choose the one with the lowest MAC address as primary. On the foreign controller, if the lowest MAC addressed anchor controller does not respond, it will connect to the second controller. Is that still true? or is there a better way to go about it?
Also, I was wondering, do I need to put different guest network ranges on each of the Anchor controller? or can I use the same exact range on both anchor controller (since if a controller goes down, the clients would be reconnecting to the second controller anyways?)
Any best way to setup redundant Anchor (guest) controllers).
I have a Cisco ASA 5505 in our office. We are currently using Interface 0 for outside and 1 for inside. We only have 1 Vlan in our environment. We have two three switches behind the firewall. Today the uplink to Interface 1, to the firewall, on the switch went bad. I want to setup a second inside interface on the firewall and configure it as failover incase this happens again. I want to attach it to the other switch. Can I do this? If so, what do I need to do? would it only be a passive/standby interface?
View 1 Replies View RelatedThe FTP server log shows no hits, from 192.168.1.4 I can telnet to 5505 no problem.
Doing everything on inside interface eth0/1, ftp server shows up and arp table of 5505 has correct mac for 192.168.1.4
ciscoasa# copy ftp://bob@192.168.1.4/asa841-k8.bin disk0:
Address or name of remote host [192.168.1.4]?
Source username [bob]?
[Code]...
I have a Cisco ASA 5510 with a strange issue. When I power it ON, the following is the status of the front panel LED:
Power is OFF
Status is Amber
Active is Amber
VPN is Green
Flash is OFF
Also nothing comes up on the console. I suspected a Power supply issue and replaced it, but still it doesn't seem to work.I cant open up a TAC as I do not have a Smart Net contract.
I got PIX 525 with failover. Due to power issue one Unit was offline for a while. During this time couple of changes was done on the Firewall.
Which Unit becomes active when I plug the Firewall unit which was offline for a while now. Each Unit has 4 Ethernet Connection
E 0/0 - connects ISP Router
E 0/1 - connects to Lan switch
E 1/0 - connects to DMZ port
E 2/0 - connects to failover unit PIX
I am having issues with monitoring our Cisco ASA5505 devices with "SolarWinds Orion NPM 10.2" through the use of SNMPv2. On some devices we see that SNMP polling stops and that the ASA's interfaces would show up as unknown - usually when the link to the device goes down/up or after a random ammount of time. At that point SNMP polling data is no longer updated and all we can rely on is ICMP for device status. I can resolve the issue by restarting the remote ASA OR restarting the SolarWinds server after which polling resumes. We are only seeing this behaviour with our remote ASA's.
Our setup is as follows:
Head End: Cisco ASA 5520 [ASA 8.3(2)]
Remote: Cisco ASA 5505 [ASA 8.3(2)]
I have found a SolarWinds article listed below that possibly identifies the issue that we are having but am not sure where to start.
[URL]
We have ASA 5540 with 8.2 SW. We are trying to download a file (3 MB pdf) from https session which fails if done behind the firewall. In case, the client bypasses firewall, the file gets downloaded as usuall. Interesting thing here to note is that when client is behind the firewall, its takes a long time to download the file and the file size always 312 Bytes, of course its a corrupt file.
View 3 Replies View RelatedThe client is only interested to have one-WAN(MPLS) and One internet circuit with Dual ASA5510 primary/failover configuration. In the event primary firewall fails, there is no direct WAN/internet connection to failover firewall. I beleived that to mitigate the issue, I needed to add a layer 3 switch , and have each circuit (MPLS/Internet) or (modems/routers) connect to a L3 switch. L3 switch will do the vlan based routing based on the state of firewall. ? am i correct? The client want automatic failover to secondary firewall in the event the actual firewall failed without impacting the day to day business.
View 3 Replies View RelatedI have CISCO pix, version 525, today while trying to save the config, I am getting below error
GPRS-PIX# wrBuilding configuration...no memory available
Error executing command
[FAILED]
Cisco PIX Security Appliance Software Version 8.0(4)Device Manager Version 6.1(5)51
Compiled on Thu 07-Aug-08 19:42 by buildersSystem image file is "flash:/pix804.bin"
[Code]....
Currently we have one ISP1 and all traffic goes to this way. Suppose our isp1 goes down, our outside user cant get the server. All servers are nated to this ISP1.We planned to purchase a another ISP2. Shall we Configure same inside server to map this ISP2? so that one primary ISP1 goes down it will take place the outside trafficISP2.
View 1 Replies View RelatedHow to configure ASA failover for 8.4.
View 1 Replies View Relateda customer have 2 pix 525 with ver 7.0.1 in a failover configuration with serial cable and 2 sc fiber interface and 2 fastethernet 1 used for failover. the strange behaviour is that when i try to do traffic from inside to dmz or dmz to inside the maximum transfer is 862Kb/s to 1MB/s not more.... i don't understand what's happened. the show mem and show cpu are normal 7% mem used and 1-2% cpu used. attached you will find the configuration.
View 5 Replies View RelatedIs it possible to setup 2 x Cisco ASA 5520 that are in an Active/Standby failover using sla monitoring?
For example ASA1 outside interface connects to an upstream switch and you setup sla monitor with icmp echo to ping that switch. The switch goes down and you need the other ASA2 to become the Active ASA. Can the sla monitor be automatically integrated with the failover commands for this to happen?
I have a ASA 5505 which is connected to a remote site which also has a ASA 5505 over a L2L VPN tunel. One of the sites has a WAN failover configured with two ISP which is working successfully.
But, when the WAN connection fails over to the backup connection the VPN link breaks as the peer site IP address has changed and the VPN can not establish a connection.
Would it be possible to configure a VPN failover so that when the connection failovers so will the VPN tunnel?
There are 2x Cisco ASA 5505 in an active/standby failover config. The primary asa 5505 has been reset and the secondary is now running as active. I would like to reintroduce the primary again but need to know how to do this.
Ideally I would like to remove the failover config and start from scratch. Do I just need to enter the following to disable failover on the active secondary box?
no failover
no failover lan unit secondary
no failover lan interface failover Vlan999
no failover interface ip failover 192.168.254.1 255.255.255.252 standby 192.168.254.2
I have a pair of ASA 5585 configured with 2 contexts, C1 & C2, C1 is active on ASA-1 & C2 is active on ASA-2 i did failover test, ping was initiated to host residing behind ASA-1 in context C1 i powered of ASA-1 then both context became active on ASA-2, however during this failover.i saw 4 ping packets drop..
View 3 Replies View RelatedConfigured ASA 5510 ISP failover and working fine.My ASA as configured as DHCP server also. So its serves IP addressing details including mask,default-gateway, DNS server IPs.Here my issue is whenever my ISP failover occurs my ASA sends previous ISP DNS server IPs to my inside clients.
Here i like to configure my ASA to serve IP addresses dynamically.Or is there any global DNS IP addresses which will work for all ISPs?
So we currently have a T1 connection at our location. We were looking to add a high speed cable internet and add an ASA 5505 with Security plus license to do failover between the two. I have found a few examples on how this would work but curious about a couple things.
We would want the Cable to be the primary, T1 as a backup.Currently the IAD that handles our T1 does dhcp, dns, and NAT.. Who/what would handle these items with the setup above?
I have an ASA-5505 which I have been managing using ASDM from a PC and a Mac.I just happens that the Mac has not been used in a little while and when I tried to use ASDM on it, it fails.I've had a trawl through various posts and release notes (after updating various components in the process, incl Java with all the diabling/security updates of late) but am still having the problem and this is where I'm at:
- the ASA runs v8.4(2) and ASDM 7.1(1)52
- release notes state that ASDM 7.1 should work on Java 7 on Windows 7 and MacOS 10.7
- ASDM starts fine on my Windows 7 PC running Java 1.7.0_13
- I am also running Java 1.7.0_13 on MacOS 10.7.5
- on MacOS, ASDM starts, asks for credentials, download/refreshes the cached app... and then crashes with the following exception message:
The root cause of the issue seems to be that a Java class called apple.laf.AquaTableHeaderUI is not found..Now, I don't know much about Java, but that seems to be an Apple UI related class - I presume that it would be good to use this to give ASDM a more native look and feel, but why on earth is there no fallback? or am I missing something?
I want to set-up a HA for ASA5510. I wanted to design the network to achieve HA. I am attaching the present set-up of the network. At present, I have 2 ISPs connections terminating in ASA5510. The configuration is done for failover in ASA5510.I have another ASA5510 and want to use it for HA. I needed to know the design for the set-up. I want a stateless failover since the amount of traffic is less. I don't have any ISP routers in the present network. I suppose I need 2 routers for HA and couple of switches. One more question is that, as there are SSL VPN users, is there any way for the users to not get disconnected when one device fails.
View 5 Replies View RelatedI have an ASA 5520, currently running version 7.25-k8. I'm preparing for an upgrade to version 7.25(4), so I transferred the software code (obtained via Cisco download) to the firewall vis SCP. I then issued the "verify flash:asa725-k8.bin" and it fails. It comes back with the error that the CRC did not verify, Data Integrity has been compromised". My first thought was the image did not copy correctly, so I deleted it and transferred it again. I got the same error. Then I decided to run a verify against the actual current code that was running on the firewall, and it came back with the same error. I don't understand what the problem is. I don't tend to think it's an SSH key related problem, as the method I use to access the firewall is via SSH and I have no problems. Worth noting,this firewall is part of an active/standby pair, and I observe the same behavior on the failover unit, it fails to verify.
View 3 Replies View RelatedI've seen you can configure stateful failover between two routers running ip inspect classic firewall: url...Can the same be done yet for zone-firewall? I cannot find any documentation on it.
View 1 Replies View RelatedWhen we had 8.2.2, we bought a Mobile license to make the iPads running AnyConnect happy. I applied it, but since we'd only purchased one license, it broke failover. 8.4 lets you share tracking licenses, and since we were planning on the upgrade to 8.4.x anyway, I figured no big deal, I'll get that straightened out when I do the upgrade.
Did the upgrade this weekend, and I still can't get things happy, the boxes don't see one-another:
Here's a show failover on the primary:
Failover OnFailover unit PrimaryFailover LAN Interface: failover GigabitEthernet0/3 (up)Unit Poll frequency 1 seconds, holdtime 15 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1Monitored Interfaces 6 of 160
[Code].....
I have 2 PIX 525, which one of them, step and active failover mode the other PIX 525, leaving this off, do not know what happened may have been a power outage, but in any case I can turn it back on? And the other question I have is if I can import a configuration that I have saved on my computer. i have the PIX device manager.
View 11 Replies View RelatedI got a problem with a cisco asa 5580 like two days ago and the device stop working (there was a mainteinance window and after that the device didn't work). Now we receive the RMA and we are trying to configure the failover so the new device get the configuration form the one that is working.
But this is the message that I gettin:
Failover message decryption failure. Please make sure both units have the same failover shared key and crypto license or system is not out of memory
We already changed the shared key and crypto license but the failover is still down, what are the features that the cisco need to activate to enable the failover?
Can I run Cisco ASA failover with dual ISP run active/standby configuration and SLA monitor to monitor the primary ISP gateway and failover to the secondary gateway but not failover to the failover firewall unless an actual event occurred that required a ASA failover?
View 3 Replies View RelatedI have this firewall working as active/standby. Everything seemed to be ok, but we noticed that confirgurations are not being replicated by saving configuration either copy run start or write. The workaround here is write standby command. Below the configs and stats, plus the show version, which is the same in both equipments:
Header 1
failover
failover lan unit primary
[Code].....