Cisco WAN :: Configure Two Links (active And Failover) On 2911?
Sep 19, 2012I need to configure two links (active and failover) on router 2911. Do I need DATA LICENSE to configure this with static router and route-map?
View 4 Replies
ADVERTISEMENT
Cisco Firewall :: ASA 5585X Active / Active Failover Group Inter Routing
Mar 20, 2012I am looking at deploying a pair of 5585X's in an active/active multiple context state. I am creating Mulitple contexts that need to be able to route to each other. I was going to deploy a type of Gateway context that has a shared interface to all of the other contexts, instead of sharing interfaces directly between the contexts, i beleive this will work as basically i am just cascadng the contexts and sharing interfaces.
The main problem i have come across, is that if i deploy active/active across two appliances using 2 failover groups i can not see a way to route between them, for example.
I have Context 1, Context 2 and Context GW A including the shared interfaces of Con1 and Con2 in failover group 1 on appliance A with the respective standbys on Appliance 2. I have Context 2, Context 4 and Context GW B including the shared interfaces of Con 3 and Con 4 in failover group 2 on appliance B with the respective standbys on Appliance 1.
I need to be able to route traffic between Context GW A and GW B so that the contexts can communicate in normal operation and in failover. I do not beleive that I can share an interface between contexts in two separate failover groups and to be honest without adding a L3 device between the appliances i am not sure if this is possible.
Cisco Firewall :: ASA5520 - Active / Active Failover In Multiple Security Contexts With Dual ISP?
Jun 1, 2011I have an ASA5520 in location A with an ISP connection and a matching ASA5520 in location B with a separate ISP connection. We have fiber connecting the two locations and vlans passing back and forth so I will be able to configure the failover via a vlan as well as extend the ISP's to each location via vlans. The Active/Active configuration with the multiple security contexts does not seem to be an issue but how is a redundant ISP configured in this mode?We want to have context A using the ASA in location A with ISP1 as the primary and failing over to ISP 2 in locaiton B We also want to have context B using the ASA in location B with ISP 2 as the primary and failing over to ISP1 in location A Would route tracking provide the desired result? Is there a better option?
View 1 Replies View RelatedCisco Firewall :: 5520 - ASA Active / Active Failover And IPS Failure
Mar 30, 2011I have 2 asa 5520 firewalls including and 1 AIP-SSM-10 module in each of them. the configuration is set using active/active failover and context mode.
Both of them run individualy the IPS module. The IPS is configured using inline mode and fail-open option. However when one of the module fails and the state is changing from up to init or anything else making the IPS to fail then failover is detected and ASA consider it as failover and bounce context to the other unit.
IPS soft is 6.0(4) and ASA soft is 8.0(3)
I have checked cisco doc and it is confusing to me. it says: "The AIP-SSM does not participate in stateful failover if stateful failover is configured on the ASA failover pair." but it really does participate. Running is not really an option because of production network impact matter..
Cisco Firewall :: ASA5585-X Active / Active Failover Using Etherchannel?
Dec 27, 2011its possible to set up active/active failover using etherchannel on 5585s?
View 1 Replies View RelatedCisco WAN :: 2911 - Load Balancing Amongst 4 Links
Dec 19, 2011I'm workig with a friend on a project. The setup in place is on yacht that has 4 V-Sats and they are wanting to load balance across all four of these links via a Cisco 2911. My recommendation to him was to just create 4 static default routes to each V-SAT's ip address.
Would this accomplish the goal of load balancing? My concern is that would it actually load balance amongst the 4 links or just choose one and then move other to another link once the initial primary went down? Also would enabling CEF be an option if its a feature the 2911 can do? I've attached the visio to give a better idea.
Cisco WAN :: 1921 Dual Links Failover And Fail Back
Sep 19, 2012I have a 1921 router with two wan interface configured, one is primary and the other is standby or backup in case the primary goes down, I was able to configure links to failover from primary to backup once there primary is down, but how do I configure to make sure when primary is up it failbak to to it. [code]
View 3 Replies View RelatedCisco WAN :: 4506 / 2 WAN Links With EIGRP Failover If Primary Fails
Jul 26, 2012I have a remote site with 2 WAN links.Link 1 MPLS with telecom provider managing the PE and advertising EIGRP routes to my switch(3750-E stack).Link 2 Directly connected to core site switch (4506) and advertising EIGRP routes.
It looks like this:
-------- Provider MPLS Cloud ------- GI2/0/1Remote Site (3750-E Stack)
Core Site Switch(4506)----
gi4/2------------------------------------------------ GI1/0/1Remote Site (3750-E Stack)
When both links are up MPLS is disrupted from other sites (that have MPLS only) to the core site. I was unable to get a route list to see what exactly was going on before shutting the directly connected link down.What i'd like to have is:Use MPLS as my primary link as it is fully meshed with all my remote sites (and not just the core) and have the directly connected link as my failover in case of issues with the primary. I assumed putting a delay 1000 on the directly connected link at the remote site would have been enough but it looks like both were active and leaking routes all over the place Is there a way to set this up that the MPLS link is favoured and if it loses routes to that specific remote site it would failover to the directly connected link?
Here is my current configuration for EIGRP on the remote and Core sites:
Remote 3750-E
router eigrp 100
redistribute connected
redistribute static
passive-interface default
no passive-interface GigabitEthernet1/0/1
[code]....
Cisco WAN :: 2911 / 2811 -Access List On Serial Links Not Behaving The Same
Aug 20, 2011I have recently purchased 2911 routers running 15.1 to replicate a system I had implemented using 2811 routers running 12.4 a few years ago. None of my applications and servers have changed, but trying to determine why my router access-list on my serial links are not behaving the same. I don't keep up with Cisco changes.
On my original system, which is a private network that distributes a lot of udp broadcast and multicast data to remote sites over 64k serial lines, I manage some of the udp broadcast data using access-lists. When I check on my 2811-based system, "show ip access-list" shows a nice distribution of filter hits showing my expected deny/permit access-list entries working as expected allowing me to filter the particular udp broadcast ports of interest on the various serial interfaces.
On my 2911 based system, with most other elements the same, the access-list is not working correctly, and I see data getting through the access control to the other side of the serial link. Using tcp dump and other tools on the remote systems my routers attach to, it looks like the access control is basically ignored... though if I "shutdown / no shutdown" the serial link between the routers, it definitely stops and restarts the flow of data, so I know data is traveling over that interface... when I run "show ip access-list" on the 2911, I see tons of hits on one deny filter, and the last "ip permit any any" filter, but other deny udp any any eq XXX port filters are simply not registering denies.. which should be triggering since I see my server sending the data, and my client systems receiving the extra data I am supposed to be filtering on the router...
Is there potentially a new feature or command set option that I am missing to correctly filter outbound data from my serial links?
On 2811 w/ an
HWIC 4A/S int s0/0/0
ip access-group sample1 out
ip access-list extended sample1
{code]...
Cisco Firewall :: How To Configure ASA5520 For Active / Active
Mar 17, 2013How to Configure ASA5520 for Active/Active
View 8 Replies View RelatedCisco WAN :: WAN Failover With 2911 IOS Version 15.1.4M
May 18, 2011I thing that i find some bug in the newest IOS 15.1.4M.
The case is falow:
I start to configure failover for the costomer - make default route, make the default path but i cant find the comand IP SLA monitor. Is some meet this problem with this IOS or just Cisco make some chenge in the CLI commands?
Tomorrow i will try with IOS version 15.1.1T.
2911 ISR - Setup New WAN Interface And Failover?
Oct 30, 2012have been tasked with completing a Cisco config update on an ISR.Client is running a Cisco 2911 running IOS version is 15.0(1)M6.They have added a new WAN interface to GigabitEthernet0/2 and are looking to setup a basic failover configuration to augment their current 0/0 Fiber connection.
View 7 Replies View RelatedCisco WAN :: 2911 ISR - View Active Concurrent Connections
Feb 18, 2013I have been looking for the command to view all concurrent active connections or sessions on our Cisco 2911. I want to see what the total connections or sessions are at peak times throughout the day.
View 4 Replies View RelatedCisco Firewall :: Failover ASA 5580 Unsync With Active
Feb 19, 2012I have encountered a problem in one of customer that the Active ASA 5580 is unable to sync with Standby Failover ASA. When Active is connected with FO and push the configs to it will not find the ethernet/Gig interfaces due to which the all the configuration were not applied and when the primary ASA the secondary is unable to respond.
When i attached console with the Standby ASA i have seen this error.
Number of interfaces on Active and Standby are not consistent.If the problem persists, you should disable and re-enable failover on the Standby.
For detail undestanding i am attaching the configs of primary and standby ASA. The KHI-DR-ASA-BB-01 is the standyby firewall.
Cisco Firewall :: ASA 5550 Lost SSH To Active On Failover?
Dec 19, 2010I am having a curious problem with two Cisco ASA 5550. They are configured in Active/Standby failover and in routed mode.The problem is: I cannot connect via SSH to the ACTIVE unit, only to the STANDBY. If a switchover is forced the problem is still the same. because it happens both with the primary and the secondary unit.It is not a L2 or a transport problem, because I can ping or access both units via ASDM.
View 8 Replies View RelatedCisco Firewall :: 5580 Failover Active And Standby
Dec 21, 2011I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.
View 5 Replies View RelatedCisco Application :: ACE 4710 - Active / Passive Failover?
Nov 14, 2012We have an ACE 4710 that has two web servers in an active/passive scenario. The issue is that if node 1 fails and node 2 takes over connections to node 2 stay active even if node 1 becomes available again. Is there are way to ensure that node one is not placed back into service if it becomes available again.
how active/passive failover shoudl be configured, so I can make sure I have it set up correctly;
Cisco Firewall :: ASA 5510 Active And Standby Failover
Apr 18, 2012i read that you need only one L-ASA5510-SEC-PL for setting up a Active/Standby Failover. I installed the license on the 1st ASA and tried to setup the failover via the ASDM wizard. It always fails, because the 2nd device can't have a 'base' license.So does this mean, i really need another license?
View 5 Replies View RelatedCisco Firewall :: Adding Failover To Active ASA 5510?
Oct 14, 2012I am adding a failover asa to an a firewall that is already in production. They are both 5510's, they both have the same abount of ram, have the same code versions. Will there be any downtime while adding the secondary in?
View 2 Replies View RelatedCisco Security :: ASA 5540 SSM-4GE Active / Standby Failover
Aug 4, 2011we had such kind of issue: while installing 2 SSM-4GE modules to 2 ASA 5540 (Active/Standby) the firewall is splitted. That's my step:
1) Turn off standby ASA and plug SSM-4GE module
2) Power it On After it was booted up failover relationships were broked and previously stabdby became Active appliance.
3) Turn off active ASA and plug SSM-4GE module
4) Power it On
After the it was booted up failover comes up and previously Active (on step 2) appliance became Standby. Everything is up and running now, but the issue was on step 2, I suppose becouse of distinct in hardware (when one ASA was on SSM reachest than another one). Still have no ideas why so happens and is there any way to plug SSM modules int ASA active/standby cluster without downtime.
Cisco Firewall :: ASA5510 Active / Standby Failover Speed
May 11, 2011I have just finished setting up two ASA5510s in Active/Standby Staeful failover, using the Management interface for both failover and state. Everything appears to be working well.Configurations were transferred and the "sh failover" on both accurately reports their status before and after a failing the active device.I monitored the inside IP with a continuous ping (using a Windows client) and noticed that there were usually two to three ping responses lost. Is this normal?
View 1 Replies View RelatedCisco Firewall :: 5510 / Setup Snmpv3 With Active Failover?
Apr 1, 2012What I am attempting to do is setup snmpv3 on two failover 5510's .The problem I am running into, the snmp management software rejects one of the devices as it sees it as having a duplicate engine ID since the two devices share the same config. Would like to know how this would work in an active/active setup being able to poll both devices.
View 2 Replies View RelatedCisco Firewall :: ASA 5540 - Active / Standby Failover Pair
Apr 13, 2011I currently have two 5540's in an Active/Standby pair. The primary unit failed on February 12th, so the secondary ASA is now the active one. My question is this - we have made a lot of changes since February 12th and I am planning on fixing this failover issue over the weekend. Will the secondary (now active) FW sync it's config to the non-active FW, or will the failed FW sync it's out-of-date config - removing any changes that we've made in the last month or so.
View 1 Replies View RelatedCisco Firewall :: ASA 5520 Active / Standby Failover - IP Addressing?
Mar 15, 2011I am getting ready to setup avtice/standby failover on our ASA 5520's and have run in to an issue.I currently only have one External IP address available. My Idea was to use a private/placeholder IP address for the standby external IP Address, will this cause any issues with the failover? I know I won't be able to access the secondary from the outside, but that is not an issue.
View 2 Replies View RelatedCisco Firewall :: Can Two ASA 5510 With Different Modules Be In Active Failover Design
Oct 23, 2012understanding clear about new Cisco ASA 5515-x, 5525-x.I know that this device supports IPS which is included to this appliance without any additional modules.But can this box support IPS and content-filering (Cisco ASA CX or so..) in the same time.
The problem also in next. Can two ASA 5510 with diffrent modules (in one AIP-SSM and in other CSC-SSM) be in active/active failover design?
Cisco VPN :: ASA 5520 - Load Balancing With Active / Standby Failover
Jul 8, 20101) 2 x ASA 5520, running 8.2
2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
Cisco Firewall :: 5540 - Active / Standby ASA Failover Configuration Changes?
May 15, 2011I have 2 ASA 5540s ver 8.3 in Active/Standby state.I am considering a future hypothetical situation where I might need to rename interfaces or reallocate redundant interface groups. Doing so obviously has a major impact on the current primary configuration. My goal would be to minimize or eliminate network downtime during the interface changes.
I am wondering if it is possible to force the secondary ASA from the standby to active state.Then temporarily disable failover on the primary unit.Make the interface changes on the primary unit Then reactivate failover on the primary unit Force the primary unit back to active and secondary unit to standby My new interface configuration would then sync from the primary to the secondary.
I believe this would work but must ensure that the secondary ASA can function as the active unit while the failover is disabled on the primary unit. Is there a set length of time the secondary unit can remain active without a failover peer?
see issues with operating the secondary unit in this manner while making changes to the primary unit?
Cisco Firewall :: 5510 Active / Standby Failover Errors
Jan 25, 2012I just added a new 5510 failover unit to an existing 5510 and when connecting my new outside interface on an Active/Standby firewall pair, i get errors messages (red x) on each port scan (monitor & syslog) although the error message indicate all ports are good...additionally the firewalls flip between active and standby non stop. I remove the new standby unit outside interface from a shared switch and everything clears up.
View 1 Replies View RelatedCisco WAN :: Configure Backup Links On 2800?
Oct 16, 2011I currently admin a WAN link between two international sites. I have a 2800 at each end. The primary connection between the two sites is 20MB Ethernet PIP MPLS BGP circuit. I also have a pair of T1's in a PPP multilink that I switch over to in the event the primary circuit goes down. I currently am doing the switch over manually. It takes me about 15 minutes to complete it, but I know there must be a way to make this an automatic process.
So a couple questions:
1) Is there a way to create an "enhanced multilink" with the 2 T1's and the Ethernet circuit in the same bundle, in effect giving me 23MBps bandwidth while still being able to maintain connectivity if one of the 3 links goes down? This is my preferred solution
and if 1 is not possible then
2) Is there a way to configure the router so if the Ethernet circuit goes down, all traffic will be automatically directed over the T1's, and then come back to the Ethernet when it's back online?
Cisco Firewall :: To Setup ASA 5525 In Active Standby Failover Mode
Feb 12, 2013I need to setup an ASA 5525 in Active/Standby failover mode. I am setting up the ASA for a company that purchased only one public IP address. The public IP address is assigned to the outside interface. My question is will failover work correctly if I don't use a secondary IP address on the failover configuration on the outside interface?
View 4 Replies View RelatedCisco Firewall :: ASA 5585 Cannot Connect To Context Active In Failover Group 2
Nov 7, 2011I am setting up a new pair of ASA 5585's in a multi-context, active/active failover design. I cannot create management SSH connection to the contexts that are assigned to failover group 2. With all the security contexts that are assigned to failover group 1 I can SSH to the inside interface IP and login without a problem. When I try to do that to the group 2 contexts there is no response from the firewall at all, PuTTY just times out.
My firewalls are running version 8.2(4). The contexts seem to be functioning normally in all other respects.
Cisco Firewall :: 5520 Running 8.4(2) - Setup Active / Standby Failover
Jan 30, 2012I am trying to setup an active/standby failover with 5520's running 8.4(2) and am having problems with it not dropping connections during the failover. I am using a portchannel from the switch to each ASA and using sub-interfaces off that. I'm using the command Failover mac address Port-Channel1 “mac-address on primary Port-Channel1” “mac-address on standby Port-Channel1”.The command goes through but doing a show interface port-channel1 doesn't show a change in the mac address on the secondary unit after a failover when it becomes active.
View 3 Replies View RelatedCisco Firewall :: Error Message When Failover From Standby To Active In ASA5585
Aug 14, 2011I have two ASA in failover with Active/standby configuration. When I switch from standby to active from the standby ASA I get a lot (like 100) of error messages like these below: [code] The failover works fine and nothing seems to be wrong with the firewalls function.
-Hardware is ASA5585-SSP-10.
-Software version: ASA 8.2(5),
ASA is in multiple mode with 17 active context. Why these error messages appear and what they mean?