Cisco Firewall :: Upgrading ASA 5580 Cluster From 7.2 To 8.2

Aug 19, 2012

we are going to upgrade our 5580 ASA Cluster from 7.2 to 8.2 and want to do it like this way ( which worked for all 7.x upgrades ) :download asa8.2 Image to primary + secondary Firewallreboot primary ( message come up " mate version ...)reboot secondary.Does it works any experience? Does it work if both firewall can see each other during the boot process ?
 
Do I have to bring the secondary into the monitor mode so the fw is not visible for the primary ?

View 2 Replies


ADVERTISEMENT

Cisco Firewall :: Upgrading License For More Context ASA 5580?

Sep 13, 2011

This is the situation I got to firewalls with failover and I need to upgrade the license so I can get more context (right now I have 5 context and I need 10) so I was looking at the procedure and I'm not sure If I need to restart the device or not. I was looking at this procedure:
 
Upgrading the License for a Failover using ASDM (No Reload Required) Use the following procedure using ASDM if your new license does not require you to reload. This procedure ensures that there is no downtime.

•1.       On the active unit, choose Configuration > Device Management > High Availability > Failover > Setup, and uncheck the Enable Failover check box. Now click Apply. The standby unit remains in a pseudo-standby state. Deactivating failover on the active unit prevents the standby unit from attempting to become active during the period when the licenses do not match. •

2.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the active unit serial number. Now click Update Activation Key.•

3.       Log into the standby unit by double-clicking its address in the Device List. If the device is not in the Device List, click Add to add the device. You might be prompted for credentials to log in.

4.       Choose Configuration > Device Management > Licensing > Activation Key, and enter the new activation key that you obtained with the standby unit serial number. Now click Update Activation Key.

5.       Log into the active unit again by double-clicking its address in the Device List. Choose Configuration > Device Management > High Availability > Failover > Setup, and re-check the Enable Failover check box.

6.       Click Apply. This completes the procedure.link: [URL]
 
But then I checked on the cisco web page that there are some license that need to reload I see this:
 
All models

#Downgrading any license (for example, going from 10 contexts to 2 contexts).#Note If a temporary license expires, and the permanent license is a downgrade, then you do not need to immediately reload the security appliance; the next time you reload, the permanent license is restored.
 
[URL]
 
So I just want to know if I'm UPGRADING from 5 to 10 context the reload applies to my situation or not?

View 1 Replies View Related

Cisco Firewall :: ASA 5500X - Next Generation Firewall - Cluster Licensing

Apr 26, 2013

I'm working on a BoM for a customer and i need to offer an ASA5525-X pair in HA with AVC and WSE subscritption, I've two question:
 
1) In order to use AVC and WSE I need the ASA bundle that includes the SSD HD right? (ASA5525-SSD120-K9)

2) In order to have both ASA's in HA, do i need to order two Suscriptions (ASA5525-AW3Y-PR) or only one that is "shared" in the cluster?

View 1 Replies View Related

Cisco Firewall :: PIX 525 Cluster

Mar 15, 2012

We currently had to RMA both PIX 525s due to increasing crc errors. After swapping the old ones with the new we are still seeing crc errors on all gig interfaces. We have swapped the gig nic's and the sfp's and the fiber patch cables, yet still the crc errors continue to climb.

Another thing that's interesting is that when we disconnect the secondary we see an increase in throughput.

View 2 Replies View Related

Cisco Firewall :: ASA-5580 / Unable To Ping Firewall

Apr 18, 2012

We are going to impliment Spectrum (CA) in my network,i have ASA-5580-20 firewall now my spectrum server want to communicate with firewall,then only it will discover the firewall logs.Now the problem is my spectrum server is in MZ zone(10.10.10.45) security leval is 70 and my inside interface(10.20.20.101) security leval is 100.
 
I am unable to ping from spectrum server to firewall because of high security leval.How can i solve this problem,can  i change my inside security leval to 69 then i think it will ping.

View 1 Replies View Related

Cisco Firewall :: Firewall / Can ASR 1006 Replace ASA 5580

Oct 30, 2011

i check ASR 1006 config with ESP-40, the firewall permonce can reach 40G, ASA 5580 is 20G, can ASR 1006 replace ASA 5580, is there any function feature problem?

View 1 Replies View Related

Cisco Firewall :: Pix 525 Cluster Failover?

May 23, 2011

a customer have 2 pix 525 with ver 7.0.1 in a failover configuration with serial cable and 2 sc fiber interface and 2 fastethernet 1 used for failover. the strange behaviour is that when i try to do traffic from inside to dmz or dmz to inside the maximum transfer is 862Kb/s to 1MB/s not more.... i don't understand what's happened. the show mem and show cpu are normal 7% mem used and 1-2% cpu used. attached you will find the configuration.

View 5 Replies View Related

Cisco Firewall :: PIX 515e Reason To Upgrade To ASA Cluster

Feb 24, 2011

Just looking for some good reasons why I should upgrade a Cisco PIX 515e cluster to an ASA Cluster to present to the business.

View 1 Replies View Related

Cisco Firewall :: ASA Version 8.6.1 NAT To Exchange 2010 Cluster?

Feb 26, 2013

We have the following setup on our Cisco ASA version 8.6.1 One to one NAT rule from outside to our Exchange 2010 cluster IP address (DAG group). This is working fine for clients on the internet accessing their emails via Exchange using their phones. The ASA has the MAC address of the active node from the cluster but when the cluster failover it cache the IP address and are not updating the new MAC when the cluster failover. So users from the outside are unable to connect to the new node from outside the ASA as the MAC address from the passive node is in the MAC table. The MAC address on all the switches update within 2 seconds on the internal network and users don't notice any outage.

View 4 Replies View Related

Cisco Firewall :: 5540 Changing Host-name In Asa Cluster

Feb 11, 2013

I have 2 cisco asa 5540's configured in active/standby mode. I need to change the hostname and domain name as per our standards. Does changing the hostname has any impact on the traffic flow?

View 1 Replies View Related

Cisco Firewall :: ASA 5585x Security Context In HA Cluster

Jun 6, 2012

I have a active-active setup with 2 cisco asa 5585x running 8.4 - the boxes ahve each 2 sec context's build-in - which gives 4 sec context in the cluster. I have 2 x 5 extra licenses (2 x ASA5500-SC-5)  which I haven't applied yet - will this give me a total of 10 or 14 security contextes? I am a bit in doubt because if I only get 10 sec contextes in this cluster then could I instead get a single 10 security context license (1 x ASA5500-SC-10) and add this - hereby I would get 12 then. 

View 1 Replies View Related

Cisco Firewall :: Management Interface In Cluster ASA 5515x?

Jan 6, 2013

I have a misanderstand about management interface configuration in cluster. So I have a cluster asa 5515X with management interface. i Would like to be able to connect to any of the member of my cluster on management interface, so i would like to fix a different ip on management interface on each of my node ip 92 and 91. I think it is the only way to make asa firmware update to access local flash on each node.
 
my config
 
interface GigabitEthernet0/1
channel-group 1 mode active
no nameif

[Code].....

View 9 Replies View Related

Cisco Firewall :: Cannot SSH / Telnet To ASA 5580

Oct 15, 2011

accessing my cisco ASA, last night we were doing VA on our ASA, after that iam not able to access it through ssh nor telnet. its not giving me any error.. i tried from different system also. SSH & telnet allowed from inside to 0.0.0.0 i have re-generated rsa keys when it was working. ASA version is 8.2 now when i connect telent is giving me blank prompt. i can login using ASDM.

View 5 Replies View Related

Cisco Firewall :: ASA 5520 - Fail Over Cluster Software Upgrade

Jul 21, 2011

last night we tried to upgrade our cluster (2x ASA5520) from 8.0(4) to 8.2(3) and failed miserably.
 
1. Both units got the new image, but when we reloaded the secondary unit then we got the following strange message:
 
"Mate's license (10GE I/O Enabled) is not compatible with my license (10GE I/O Disabled). Fail over will be disabled."
 
After this message fail over was not there anymore and both units became active (!!!) which killed everything. Of course ASA5520 doesn't have 10GE and we have exactly the same units. What could be the problem here? Currently we run with a single unit with 8.2(3) and the secondary unit is switched off.
 
2. After the upgrade we cannot connect with multiple VPN sessions from the same client, this gets logged:
 
"Multiple sessions per tunnel are not supported"
 
This was working just fine with 8.0(4) and doesn't work with 8.2(3). Do we have to update something in the config or what is causing this? If you ask why we went with 8.2(3) instead of 8.2(5) then the answer is because we were testing that for several month in our secondary data center, but unfortunately only on a single ASA and not on a cluster. We couldn't go higher due to the 512MB RAM we have in all units.
And we had to upgrade, because we had crashes with 8.0(4) which was working fine for a long-long time.

View 7 Replies View Related

Cisco Firewall :: Cannot Activate Failover On Asa 5580

Sep 27, 2011

I got a problem with a cisco asa 5580 like two days ago and the device stop working (there was a mainteinance window and after that the device didn't work). Now we receive the RMA and we are trying to configure the failover so the new device get the configuration form the one that is working.
 
But this is the message that I gettin:
 
Failover message decryption failure. Please make sure both units have the same failover shared key and crypto license or system is not out of memory
 
We already changed the shared key and crypto license but the failover is still down, what are the features that the cisco need to activate to enable the failover?

View 5 Replies View Related

Cisco Firewall :: ASA 5580 Arp Collision Errors?

Feb 11, 2012

I am receiving allot of Errors "%ASA-4-405001: received ARP collision from IP/MAC on interface dmz1 with existing ARP Entry IP/MAC
 
When i checked this MAC address in the same firewall it shows too many IP Addresses. What could be the reason ?

View 0 Replies View Related

Cisco Firewall :: 5580 - Can't Ping ASA Different Interfaces

May 23, 2012

We are using Cisco ASA 5580 (8.2) firewall. When i try to ping from inside lan to firewall DMZ interface IP it is not pingable and but from inside users i am able to ping firewall inside interface IP address.
 
I think we can't ping to other interfaces of ASA by default. But can we allow the single IP address who can ping all the interfaces of firewall?
 
We are not doing any natting in firewall, for that we used the Load Balancer.

View 7 Replies View Related

Cisco Firewall :: ASA 5580-20 System LED Flashing Red

May 16, 2011

A customer's ASA is presenting the System LED flashing red.I have already analysed the show tech-support and show environment output: Found nothing, everythink seems OK.Cisco ASA 5580-20 - 8.2.1.Single appliance, no failover, multiple context and transparent mode.

View 5 Replies View Related

Cisco Firewall :: Does ASA 5580 Support NAT-PT For IPv6

Mar 29, 2011

I want to ask that does ASA 5580 support the nat-pt for IPv6?

View 2 Replies View Related

Cisco Firewall :: ASA 5580 Command Itself Is No Longer Used

Mar 5, 2011

i'm new with the asa's...i'm familiar with the FWSM's on 6500's and pix..I'm running Version 8.3(2) and i wanted to setup nat-control and use of identify nats for advertising inside subnets to my outside networks.
 
the old command was static(inside,outside) 10.x.x.x 10.x.x.x netmask 255.255.255.x i'm having a little difficulty decyphering the pdf about the static nat...the command itself is no longer used, nat-control is no longer used, but i'm not quite sure what the equivalent nat command is that equates to the old static inside,outside command.

View 8 Replies View Related

Cisco Firewall :: ASA 5580-20 System LED Is Flashing Red?

Apr 8, 2012

In my ASA 5580-20 system LED is flashing RED how can i trobleshoot this.
 
I checked rarepanel everything is ok also i saw environment also showing ok

View 1 Replies View Related

Cisco Firewall :: Migrate To Multiple Context Mode On ASA 5520s Cluster?

Jun 4, 2012

I have a pair of ASA 5520s in active/standby failover mode, single context.  I'll be migrating to multiple context mode later this week.  Do I need to break failover first?  Or if I don't need to, should I?  Or can I do this while maintaining failover?  Can either of these scenarios will work (or fail).  I'll be remote, doing my work via SSH, but have somebody local who can console in if needed.
 
Migration option #1
Log into active/primary ASA
Configure Multiple Context mode
Reboot both devices
Login to active/primary ASA

[code]....

View 1 Replies View Related

Cisco Firewall :: 6509 - Replacing Faulty FWSM Module In Cluster

Apr 15, 2013

We have a faulty FWSM module in Cisco 6509 switch in Active/Standby cluster mode
 
We have purchased a refurbished FWSM module to replace it. It has the same FWSM OS 4.0 (4) and is in factory default configuration
 
What procedures should I follow to make this unit live and sync the config between the current active unit to this one.

View 1 Replies View Related

Cisco Firewall :: Failover ASA 5580 Unsync With Active

Feb 19, 2012

I have encountered a problem in one of customer that the Active ASA 5580 is unable to sync with Standby Failover ASA. When Active is connected with FO and push the configs to it will not find the ethernet/Gig interfaces due to which the all the configuration were not applied and when the primary ASA the secondary is unable to respond.
 
When i attached console with the Standby ASA i have seen this error.
 
Number of interfaces on Active and Standby are not consistent.If the problem persists, you should disable and re-enable failover on the Standby.
 
For detail undestanding i am attaching the configs of primary and standby ASA. The KHI-DR-ASA-BB-01 is the standyby firewall.

View 2 Replies View Related

Cisco Firewall :: ASA 5580 With 4*10 GB Module Act / Act Failover Not Working

Jul 11, 2012

If we switch from primary to secondary firewall the interfaces on the secondary  go to state waitung than to failed. after awhile the secondary gives the control to the primary.
 
it seem that traffic passes the secondary firewall during this short failover time . we have several context created  on the firewall, Switch Ports checked , cabeling check everythink checked
  
blackhole Interface inside (10.255.102.134): Normal (Waiting)
blackhole Interface shared (10.255.102.134): Normal (Waiting)         
blackhole Interface inside (10.255.102.133): Failed (Waiting)
blackhole Interface shared (10.255.102.133): Normal
blackhole Interface inside (10.255.102.133): Normal (Waiting)
blackhole Interface shared (10.255.102.133): Normal

View 5 Replies View Related

Cisco Firewall :: ASA 5580 - Possibility To Generate Activation Key

Nov 23, 2011

We got a replacement ASA 5580 from Cisco. We were not aware of PAK, Is there any other possible to generate Activation key? Can we generate PAK or Activation Key using SO (service order) number?

View 1 Replies View Related

Cisco Firewall :: 5580 Failover Active And Standby

Dec 21, 2011

I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.

View 5 Replies View Related

Cisco Firewall :: Synchronizing Two Firewalls In Two Different Location 5580

Jun 14, 2012

I have two firewalls in 2 different locations. They act as primary and secondary for my WAN connectivity. I would want a way to synchronize access-lists in both without manually replicating.(access list, NAT and Route)FW model cisco 5580

View 1 Replies View Related

Cisco Firewall :: ASA 5580 - Ping Allowed But Not Configured?

Apr 4, 2012

We have a Cisco ASA 5580 and the outside interface has a public IP address and we noticed we can ping this address from the Internet. I did a packet capture on the outside interface and confirmed the pings and the IP address sending the pings. The 5580 does not have an access list allowing icmp so I'm not sure what is allowing the pings to this interface.

View 5 Replies View Related

Cisco Firewall :: 5580 Do Static Command Needed

Oct 3, 2011

The firewall is running version #8.2 on ASA 5580. Address translation is not needed on Inside network and Outside network.But the customer has hundreds of static command as below.. [code] Can they all be removed and replace with one single command as below? 

View 1 Replies View Related

Cisco Firewall :: 5580 Need To NAT Addresses To Inside Servers

Jul 7, 2012

We are going to setup a L2L VPN with a vendor and they asked us to NAT a couple IP addresses for remote access to a couple of servers on our inside network. Our device is an ASA 5580 with version 8.1 and we have a handfull of public IP addresses for use if needed. The vendor's remote network is a public IP address but for this posting I will use 192.168.10.0. Our inside servers are 10.100.10.20 and 10.100.10.30. Because 10.100.10 is in use with another customer they asked us to NAT 10.77.97.20 and 10.77.97.30 to the two inside servers.

View 2 Replies View Related

Cisco Firewall :: 5580 - ASA Supports NAT In Bridge Mode?

Oct 31, 2011

Does ASA supports NAT in bridge mode? especially the 5580 series x??

View 1 Replies View Related

Cisco Firewall :: 5580 Not Pinging Virtual Interface

May 1, 2012

I have got new cisco ASA 5580 running 7.2(4) on it  when i am trying to configured Virtual interface on vlan 400 in  Gi0/0.400 to LBASE.now the problem is from my MZ zone 10.242.107.17 to Lbase virtual interface 10.242.103.1 iam not able to ping.

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved