Cisco Firewall :: Continuous Crashes With ASA 8.2(5)22 On Standby Unit

Mar 8, 2012

I've tried to upgrade a redundant setup from 8.2(4)4 to 8.2(5)22 ending with a stanby ASA continuously crashing after config sync phase. On the first crash it even corrupted the flash, leaving me no choice than initializing the box from scratch.

View 4 Replies


ADVERTISEMENT

Cisco Switching/Routing :: 4948 E HSRP Connect Devices To Standby Unit That Do Not Require Redundancy

Jul 29, 2012

If I setup 4948E's in HSRP configuration.  And I connect devices to the Standby Unit that do not require redundancy.  Will there be any issues passing traffic?  I don't believe that standby unit blocks the traffic but wanted to confirm.

View 5 Replies View Related

Cisco Firewall :: ASA 5520 8.0(5) Write Standby Causes Standby Interface Down / Up

Sep 22, 2011

last night I started upgrading our ASA5520 active/standby cluster. Because of lack of memory, I stopped the upgrade process and will continue when the memory modules have arrived... Currently I'm running 8.0(5) on both nodes (Version: Ours 8.0(5), Mate 8.0(5))Whenever I use the "write standby" command on the active ASA, the passive ASA seems to drop it links for a short while. [code]

View 4 Replies View Related

Cisco Firewall :: ASA 5550 - Continuous Rebooting Loop

Nov 19, 2012

we have a Cisco ASA5550 and stuck into continuous rebooting loop. it show an error :assertion "_vf_mode_init" failed: file "vf_api.c", line 99
 
Earlier it has an 4GE SSM module, for some reason we want to utilize 4GE SSM module and we unplugged and after that we face this issue. Error message file is attached.

View 1 Replies View Related

VPN And Firewall In A Single Unit Or Separate?

Sep 9, 2012

I have some technical consultations that I would like to know which would be a better implementation.

I am seeking for clarifications whether putting VPN and firewall in a single software or separating both into separate software.

View 3 Replies View Related

Cisco Firewall :: Dispatch Unit High CPU ASA 5550

Jan 29, 2012

I'm trying to do some research on the Dispatch Unit process.  It seems High CPU and this process go hand in hand.  I haven't figured out an effective way of determining what underlying issue is the actual source. How to understand what the Dispatch Unit process is doing?  I have an ASA 5550.  I have seen the cpu hover around 85% +- 5% for sustained long periods, 30 - 60 min +.  I have always been under the impression that around 80% cpu and you're probably dropping packets (that could be an out-dated belief).

View 58 Replies View Related

Cisco Firewall :: ASA 5505 During Set Up Lost Contact With Unit

Feb 4, 2012

Did setup iaw instructions. got to step 9 where it went into configure mode.  last few messages 

192.168.1.5 to 192.168.1.1 (BUILT IN BOUND TO TO IDENTIFY),   then
192.168.1.5 START SSL HANDSHAKE FOR TLSW1 SESSIN, THEN
192.168.1.5 COMPLETED HANDSHAKE, THEN

[Code].....
 
now i am unable to do anything with the 5505. can not log in , can not get a ping of 192.168.1.1, can not get into the unit and do a factory reset

View 3 Replies View Related

Cisco Firewall :: Rebuild ASA 5520 Failover Unit

May 12, 2011

What process I need to follow to rebuild my failover unit? I've had to turn it off because it seems that both the primary and secondary were thinking they should both be the active unit. I'm not sure why. But in turning off the failover, I had internet access again. So I think I want to rebuild the secondary unit's configuration. Do I need to turn off failover from the primary unit first? Disconnect the secondary unit, console into it and remove the configuration (command to remove from flash?)? Rebuild the interfaces..all interfaces or just STATE between the units? Just trying to get a list of the process

View 1 Replies View Related

Cisco Firewall :: ASA5510 Secondary Firewall Crashes After Upgrade To 8.4.1

Jun 29, 2011

I have two ASA5510's set up in failover, and the secondary keeps crashing after doing the interface checks when bringing failover up. This only happens if I try to upgrade the image on the secondary to anything newer than 8.4.1 (I've tried with 8.4.1-11 and 8.4.2). The primary one run just fine with new images.
 
I don't have the exact error right now, as I need to do a screen capture from console. It's just a huge crash dump.Are there anything I might have missed during the upgrade? Should I cold-boot both the firewalls in the correct order?

View 7 Replies View Related

Cisco Firewall :: 5510 - ASA Dispatch Unit Percentage Increasing

Jan 25, 2012

I have just noticed that my Cisco ASA 5510 cpu utilization increasing upto 30-35 % and when i issue sh processes cpu-usage, i have found dispatch unit occupied most of utilization.

View 4 Replies View Related

Cisco Firewall :: ASA 5520 Failover Unit Anyconnect Licenses

Jan 2, 2012

So i setup a failover active / passive with 2 ASA5520's
 
Primary asa has 750 Anyconnect vpn licensing and the secondary asa has 2 Anyconnect licenses     
 
I haven't setup the second asa with the new 750 licenses i purchased but when i do a show version it shows that the failover licensed features shows 750...
 
Does this mean i do not have to install the secondary anyconnect licenses on the standby ASA unit?
 
output of secondary asa
:
Licensed features for this platform:Maximum Physical Interfaces       : Unlimited      perpetualMaximum VLANs                     : 150            perpetualInside Hosts                      : Unlimited      perpetualFailover                          : Active/Active 

[Code]......

View 1 Replies View Related

Cisco Firewall :: 5510 ASA Failover Pair For Access Second Unit Via VPN

Jun 11, 2009

we are running two failover pairs of asa (5510, 5505) in two different locations in active/standby configurations.Is it possible to access the inside ip of the standby unit via vpn terminated by the active unit? It's only for monitoring.With our configuration here it is not.Is that possible in general?

View 6 Replies View Related

Cisco Firewall :: ASA 5550 To Setup Unit / Cannot Configure IP In Interface

Nov 12, 2011

I am normally only doing IOS config. I have little problem when trying to setup this unit.,It boots ASA software 8.0.4 fine.,When i go to enable mode and into configuration mode and try to configure ip on an interface i have a problem.,

ciscoasa(config)# intciscoasa(config)# interface manciscoasa(config)# interface management 0/0ciscoasa(config-if)# ?,Interface configuration commands:  default      Set a command to its defaults  description  Interface specific description  dhcp         Configure parameters for DHCP client  duplex       Configure duplex operation  exit         Exit from,interface configuration mode         Interactive help for interface subcommands  no           Negate a command or set its defaults  shutdown    ,Shutdown the selected interface  speed        Configure speed operationciscoasa(config-if)#

I did try to upload the new software 8.4.2 from rommon using TFTP. ,It boots 8.4.2 fine, but  have same problem as in 8.0.4.,I did try to create a user haveing priv 15 and logging on as that user. It gives the same.,The firewall is not in transparent mode.

View 3 Replies View Related

Cisco Firewall :: Integrating Secondary Failover Unit ASA 5510?

Nov 20, 2011

I have a single production 5510 with 2 contexts.  Now I want to integrate the secondary failover unit. My question is: How much configuration needs to be done on the secondary firewall?  How much of the configuration will be sync'd from the primary to the secondary when the secondary is connected?
 
For example, do I need to add the following on the secondary or will it be sync'd from the primary?
 
admin-context NAME
context NAME
allocate-interface Ethernet0/0.14

[Code].....

View 3 Replies View Related

Cisco Firewall :: Replacement Of Primary Unit Failed ASA5510

Sep 7, 2011

I have an issue bringing up my RMA'd primary ASA unit.
 
So what happened so far:
 
1. primary unit failed
2. secondary took over and is now secondary - active (as per sh fail)
2. requested RMA at Cisco
3. got ASA and checked that Lic (SSL), OS (8.2.2) and ASDM are at the same level as the secondary
4. issued wr erase and reloaded
5. copied the following commands to the new (RMA) primary unit:
failover lan unit primary
failover lan interface Failover Ethernet3
failover interface ip Failover 172.x.x.9 255.255.255.248 standby 172.x.x.10
int eth3
no shut
failover
wr mem
6. installed primary unit into rack
7. plugged-in all cables (network, failover, console and power)
8. fired up the primary unit
9. expected that the unit shows:
Detected an Active mate
Beginning configuration replication from mate.
End configuration replication from mate.
10. but nothing happened on primary unit
 
What is a valid and viable approach in replacing a failed primary unit? Is there a missing step that hinders me to successfully replicate the secondary - active config to the primary - standby unit.
 
I was not able to find anything related to ASA55xx primary unit replacement with a clear guideline or step by step instructions.

View 10 Replies View Related

Cisco Firewall :: ASA5520 Unit Not Accessible On Network For Initial Configuration

Dec 15, 2011

We received an ASA5520-K8 through Cisco's Loan program so we could demo it as a replacement for our aging Cisco 3005 VPN appliances.  Given that we are a non Cisco shop (except for specific appliances like concentrators and wireless access points), I don't have a great deal of experience with Cisco gear.I started to set to setup the appliance this morning but immediately ran into issues.  The 5520 doesnt seem to be acting as a DHCP server, and worse yet, I can't access the unit even if I hard code the IP on the PC being used for configuration.  I have to say that I feel kinda stupid having to post this, since I actually followed the documentation avaiable for this menial task and I fully expect the problem to be a simple one.  Namely, I am using two specific sources of info for connections.

View 20 Replies View Related

Cisco Firewall :: 5520 - Procedure To Replace Failed Secondary ASA Unit

Apr 10, 2012

i just received a RMA for failed ASA 5520 that was acting as secondary unit in multicontext configuration. What would be correct procedure to install it back in production? Do i need to restore backed up config of the fallen unit or is it just enough to enable multimode and connect to existing (primary) unit? Any good link for documentation that deal with this issues.

View 5 Replies View Related

Cisco Firewall :: Monitoring ASA 5505 Firewall Active / Standby Pair Using SNMP?

Sep 7, 2011

How I can actively monitor the interfaces and overall status of 2 x ASA 5500s in an Active/Standby configuration?
 
I can setup monitoring of the interfaces on the Active member but I'm not sure how to manage the Standby member?

View 1 Replies View Related

Cisco Firewall :: ASA 5550 With IOS 8.0(2) Crashes

Jan 31, 2012

we had just installed our ASA 5550 with IOS 8.0(2) a couple of week ago.
 
2 interfaces from each slot are being used ie 0/0 for Branch users comming via MPLS cloud ,  0/1 for internal LAN users comming form Core Switch  & 1/0 for Server farm LAN   , 1/1  for Internet (outside)
 
the first 3 interface are considered inside with sec set at 100   while the 1/1 is outside with sec at 0.
 
Last night it suddenly started dropping all connections without any warning  or any noticible log form the ASDM logging.
 
the connection drop would happen for 2 - 3 minutes and would work fine for the next 15 minutes or so..
 
after conencting the console , we found out that the IOS would suddelny go abrupt and show this display ...
 
TP-ASA(config)# TP-ASA(config)# TP-ASA(config)# Thread Name: Dispatch UnitPage fault: Address not mapped    vector 0x0000000e       edi 0x24d184b0       esi 0x0000000d       ebp 0x1c6ceaf8       esp 0x1c6ceae0       ebx 0x09e965e0       edx

[Code]....

View 2 Replies View Related

Cisco Firewall :: Botnet Filter Crashes ASA5505

Feb 27, 2011

I have a problem with my ASA5505 after enabling botnet filter my ASA reboots.Also while booting it usualy takes around 30minutes of random cycles before loading the OS. It seems to be falling at the license check.To fix the boot I usualy unplug the ASA for about 15minutes and then it will boot up fine.

View 3 Replies View Related

Cisco Firewall :: 1941 - Content Filter Crashes Router

Apr 7, 2011

I seem to be experiencing a problem with content filtering on our 1941, if I add anymore patterns to the policy below the router crashes and requires a reboot, not sure why?
 
parameter-map type urlfpolicy trend cptrendparacatdeny0
max-request 5000
max-resp-pak 1000

[Code].....

View 1 Replies View Related

Cisco Firewall :: Access Of Asa 5510 In Standby

Feb 28, 2013

Is there a way to access the asa in a failover pair that is in standby mode from the primary asa? IE I am logged into the primary asa via command line and was hoping to access the other asa from here.

View 1 Replies View Related

Cisco Firewall :: ASA 5550 Active / Standby With SSL VPN

Jun 12, 2011

I would like to work with two ASA's 5550 in HA (Acitve-Standby)  like perimetral firewalls and also work with another ASA 5540 but like a SSL VPN Remote Access to end users.Which will be the best topology to this scenary?. Perhaps i need to put the ASA 5540 SSL VPN together with the ASA's in HA directly in a port.

View 1 Replies View Related

Cisco Firewall :: 8.4(2) Upgrade Standby IP Unreachable

Oct 18, 2011

I'm having an issue where when I upgrade from 8.2(5) to 8.4(2) on an active/passive asa 5585 running in transparent mode I can no longer reach the standby ip. The BVI interface appears to be created properly, the device IP and standby IP are listed in the config under the BVI interface and my inside and outside interfaces are both joined to BVI1-group. 

View 1 Replies View Related

Cisco Firewall :: ASA5540 Configured With Standby IP

Aug 6, 2012

I have this 2x ASA5540 firewall and notice the it is configured with a standby ip. The firewall is run in Active/Passive mode.However, the standby ip of this firewall is not point to the secondary firewall and vice versa for the primary firewall. [code]

1) May i know how is this configuration valid in the first place? I have checked through the configuration. None of the configuration is related to this ip address.
 
2) Can we remove this standby ip address on both the firewall and correct to the correct primary and seconadary ip address in both firewall?
 
3) We tried to use this ip address but cannot be used ? Is it related to the configuration of the standby ip address.Do note that the ping to this ip address x.x.x.120 is unreachable.

View 1 Replies View Related

Cisco Firewall :: 5510 - Standby ASA Keeps Crashing

Feb 13, 2012

I have 2 x 5510's in active/standby mode, things look fine until the active one needs to be failed over and I realize the standby one is dead.  I never notice as the lights on the ASA look good, I only nice as I can't telnet or console onto it, how can I debug this issue?

View 1 Replies View Related

Cisco Firewall :: 6509 Standby IP Not Working?

May 8, 2011

I have successfully completed HSRP and failover configuration.When both switch are runnign then the failover run successful and wheneber one link fail then the failover run successfully but when down one 6509(total box) the failover not working.....

View 7 Replies View Related

Cisco Firewall :: ASA5510 / Can't Communicate With Standby IP

Jul 29, 2012

I can no longer communicate with the standby IP address configured on the inside interface of a secondary ASA5510. Just a couple days ago I could snmp, http, ssh, and ping it.From the switch that is directly connected to the inside interface I'm getting unexpected results when viewing the the arp table. The switch is saying the IP address associated with the ASA's inside interface has mac address 0023.3353.bcc8 but the ASA is saying its inside interface mac address is 0023.33bb.8362?Furthermore when I issue the "sh mac address-table interface f5/46" command on the switch i see multiple macs on the interface that is connected to the inside interface of the ASA...
 
Unicast Entries
vlan   mac address     type        protocols               port
-------+---------------+--------+---------------------+--------------------
135    0023.3353.bcc8   dynamic ip                    FastEthernet5/46     
135    0023.3353.bdc8   dynamic ip                    FastEthernet5/46     
135    0023.3353.bec8   dynamic ip                    FastEthernet5/46     
135    0023.3353.bfc8   dynamic ip                    FastEthernet5/46 

View 1 Replies View Related

Cisco Firewall :: CSCsg43844 Standby Pix With High Memory

Jul 3, 2012

Come across pix 525 with 7.2.4 , 256 MB RAM, experienceing high memory utilization ?.show memory was giving used memory = 97%.All I had done was, i did a reboot of the firewall since we were not able to take the control of the f/w.I wonder why only the standby f/w had this issue and not the primary does not have, just to rule out that it was not due to Traffic.I have searched in bugtool kits and support forums and did not find anything relevant except for a similar issue for ASA CSCsg43844.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Active / Standby Configuration?

Sep 21, 2011

i have 2 ASA 5505 running 8.3(1) and ASDM 6.3(1).
 
the first unit is currently working, and i now wish to configure the second unit as standby. im configuring through the ASDM GUI. Started the HA Wizard, choose Active/Standby configuration and enter the IP of the peer device. checks come back all ok. On the LAN link configuration page (step 3of6) Interface is pre selected as VLAN99, I give it a logical name as iface_fail, and enter 10.0.0.1 as primary address and 10.0.0.2 as standby, subnet as 255.255.255.248, and select port Ethernet0/5
 
Note that if i click on the buttons next to the IP fields, i get IP addresses of remote hosts!.

View 1 Replies View Related

Cisco Firewall :: Upload New Image To Standby ASA5520?

Nov 30, 2011

I have a pair of asa5520's in active/standby configuration.  I plan on ugrading the asa/asdm images to 8.4 shortly (currently on 8.0) and would like to do this with zero downtime.  Specifically, I would like to upload the new software to the standby unit, upgrade it, swap standby/active units and then upgrade what will become the standby after the swap.The problem I'm having is getting the new images uploaded onto the standby unit.  I've read that the routing table is not shared from the primary and the USB ports are "for future use".  I have no problem uploading the new images to the active unit via tftp...but can't do the same to the standby.

View 5 Replies View Related

Cisco Firewall :: Configuration Updates To Standby ASA5510?

Aug 21, 2011

Is there a document that explains how the configurations are updated to the standby ASA and what needs to be manually added tot he ASA?  I have two ASA 5510 running ASA ver 8.3(2) and ASDM 6.4(1).  When I add static routes to the primary ASA the routes are not sent to the failover ASA.  Is this to be expected or do I have a bug? 

View 10 Replies View Related

Cisco Firewall :: 5580 Failover Active And Standby

Dec 21, 2011

I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved