Cisco :: See An Active / Standby Mac Address Section In ADSM?

Dec 17, 2012

I'm not quite ready for the Automatic Failover feature that the ASA 5520 support. For now we have a cold stand by unit. I was wondering if I can change the mac addresses of the standby unit's interfaces to be exactly the same as the primary unit. I see an active/standby mac address section in ADSM, but I think that is used in the automatic failover function.

View 12 Replies


ADVERTISEMENT

Cisco Firewall :: Cat6500 FWSM Active / Standby IP Address

Jul 24, 2011

I have 2 FWSM running on 2 Cat6500 chassis, they work as a Active/Stanby group. Firewall mode is transparent. [code] HA is running well, but I can not ping the standby IP (10.98.1.248). So what could be the problem?

View 3 Replies View Related

Cisco :: LMS 4.0.1 - Duplicate IP Address Caused By ACE Active / Standby Setup?

Dec 17, 2011

I am using LMS 4.0.1 to monitor the data center network devices. I have two core switches, each core switch has an ACE module installed on it. I have configured many virtual context on each ACE module, and these ACE contexts are acting as primary and standby roles. The problem i faced with is LMS reports the virtual ip address configured on each ace context as duplicate ip address, and i didn't know how to deal with it. As to my understanding, this should be the normal behavior due to my setup, but how can i remove this alarm on LMS 4.0.1?

View 1 Replies View Related

Cisco Firewall :: ASA 5520s From Active / Standby To Active / Active

Jul 17, 2012

I have a pair of ASA 5520s operating in failover pair as active/standby, having two contexts on them. I am planning to share the load and make it active/active making first context active on the primary unit and second context active on the secondary unit. My question is if this will disrupt any connectivity thru these firewalls when I do "no failover" on the active/standby and assign the contexts to different failover groups and enable the failover back.

View 6 Replies View Related

Cisco WAN :: 4507 R - Active SUP Lost Connection And Standby Came Active

Apr 10, 2011

I faced one problem in our core switch 4507 R . Active sup lost connection and standby came active. We got lot of errors/alerts on console shown below. [Code] Also when I reloaded the switch with reload command only both sups got reloaded but I want to reload all the modules but reload command do not gives any options for that.

View 2 Replies View Related

Cisco :: How To Get LMS 4.2 Active / Standby

Dec 13, 2012

We are preparing to upgrade from LMS 3.2 where we run 2 seperate independant instances in seperate locations for redundancy.  Each instance forwards syslog traps to a seperate Openview system in the associated location.  Device updates are manually done on each system.
 
To reduce costs and administrative overhead we are considering switching to an active-standby environment when we upgrade to LMS 4.2 where the active system would forward traps to both Openview systems.
 
Any experience with an active-standby Ciscoworks LMS 4.2 environment, specifically; When one system becomes unavailable (due to network, system or application issues) is promoting the standby system to active automatic?How long does it take?
 
Does the standby system still monitor syslog events and initiate automated actions? Where the active system stops working or hangs and the standby system does not go active?
 
Are there any reliability issues with database updates or synchronization from the active system to the standby system? Is there a way to test communications from the standby system for new device turn-ups without making it active?

View 1 Replies View Related

Cisco Firewall :: ASA 5550 Active / Standby With SSL VPN

Jun 12, 2011

I would like to work with two ASA's 5550 in HA (Acitve-Standby)  like perimetral firewalls and also work with another ASA 5540 but like a SSL VPN Remote Access to end users.Which will be the best topology to this scenary?. Perhaps i need to put the ASA 5540 SSL VPN together with the ASA's in HA directly in a port.

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Active / Standby Configuration?

Sep 21, 2011

i have 2 ASA 5505 running 8.3(1) and ASDM 6.3(1).
 
the first unit is currently working, and i now wish to configure the second unit as standby. im configuring through the ASDM GUI. Started the HA Wizard, choose Active/Standby configuration and enter the IP of the peer device. checks come back all ok. On the LAN link configuration page (step 3of6) Interface is pre selected as VLAN99, I give it a logical name as iface_fail, and enter 10.0.0.1 as primary address and 10.0.0.2 as standby, subnet as 255.255.255.248, and select port Ethernet0/5
 
Note that if i click on the buttons next to the IP fields, i get IP addresses of remote hosts!.

View 1 Replies View Related

Cisco VPN :: ASA 5510 - SSL VPN Shared License In Active / Standby?

Oct 4, 2012

I recently picked up two ASA5510s (ASA5510-SSL50-K9 & ASA5510-SEC-BUN-K) with intentions of creating an Active/Standy configuration. I'm receiving the error message "Mates' license (2 SSL VPN Peers) is not compatible with my license (50 SSL VPN Peers)", but I was under the impression that I didn't have to buy idential SSL VPN licenses post 8.2 in an Active/Standby configuration.  am I missing a step that enables the license transfer(sharing?) feature to work correctly before the failover will build correctly?

View 6 Replies View Related

Cisco Firewall :: 5580 Failover Active And Standby

Dec 21, 2011

I have a problem with failover. On My site I have 2 Firewalls 5580. And I did this configuration on my firewall.interface GigabitEthernet3/0description LAN/STATE Failover Interfacespeed nonegotiate.

View 5 Replies View Related

Cisco Firewall :: 5510ASA Active / Standby Not Switch

Feb 8, 2012

I would like to ask you about ASA 5510 (Active/Standby). i have two ASA 5510 and i did configuretion failover and it is working ( Active / Standby) but my issue that when primary donw, the standby unit up to primary but the primary came back the standby unit it not switch to standby (  i mean it still up ) . if i want to primary up i type command ( failover active ) on primary unit , so i don't want use manul command i want it auto.Which command that make ASA failover when primary coma back? [code]

View 2 Replies View Related

Cisco Firewall :: ASA 5510 Active And Standby Failover

Apr 18, 2012

i read that you need only one L-ASA5510-SEC-PL for setting up a Active/Standby Failover. I installed the license on the 1st ASA and tried to setup the failover via the ASDM wizard. It always fails, because the 2nd device can't have a 'base' license.So does this mean, i really need another license?

View 5 Replies View Related

Cisco VPN :: Configuring Two ASA 5520s In Active / Standby Configuration?

Feb 12, 2012

I'm working on configuring two ASA 5520's in an Active/Standby configuration.  I've got almost everything the same between the two units for AnyConnect to work expect the following two items:

     AnyConnect Client Profiles
     AnyConnect Client Software
 
If I upload the software manually to the Standby unit I get warning about them not being in sync and on the active unit if I do a 'write standby' it does not copy the profile or software.

View 2 Replies View Related

Cisco Firewall :: ASA 5520 Active Standby And IPS Configure

Mar 3, 2013

I have two ASA 5520 version 8.2 in active Standay Mode. What is a good practice to setup IPS AIM ssm-20 for this setup.
 
Is IPS should be in Fail-Open or Fail-Close mode ?
 
Is Mangement ip for both IPS module should be same or diffrent. ?

View 6 Replies View Related

Cisco Security :: ASA Migration From 8.2 To 8.4 (active / Standby) Without Outage

Mar 21, 2012

I need to upgrade a pair (active/standby) of ASA from 8.2.5 to 8.4.3 ... I have a script created to modify all NAT rules I need, and I have tested it in lab, and I think I'm good with it. Now, I want to figure out if there's a way to do this without an outage. Previously, when configuration were compatible between version, there was no problem. You could usually force secondary unit to be active, upgrade primary (rebooting), making primary the active again, and do the upgrade on secondary ... no outage at all
 
Now, as new software doesn't support old configuration, if I follow that process, as soon as I bring primary up with new software, it will try to get the configuration from the active one, which won't work ... Is there another option than having a short outage (turn off secondary acting as active, while primary is coming back with new software and configuration already changed?)

View 3 Replies View Related

Cisco Security :: ASA 5540 SSM-4GE Active / Standby Failover

Aug 4, 2011

we had such kind of issue: while installing 2 SSM-4GE modules to 2 ASA 5540 (Active/Standby) the firewall is splitted. That's my step:

1) Turn off standby ASA and plug SSM-4GE module

2) Power it On After it was booted up failover relationships were broked and previously stabdby became Active appliance.

3) Turn off active ASA and plug SSM-4GE module

4) Power it On

After the it was booted up failover comes up and previously Active (on step 2) appliance became Standby. Everything is up and running now, but the issue was on step 2, I suppose becouse of distinct in hardware (when one ASA was on SSM reachest than another one). Still have no ideas why so happens and is there any way to plug SSM modules int ASA active/standby cluster without downtime.

View 2 Replies View Related

Cisco Firewall :: 5510 - ASA Active / Standby Configuration

Jun 4, 2012

I currently have a LAN-based failover setup between two 5510s. The failover link is a crossover cable. In the current setup, if I unplug the crossover cable both units become active. From what I understood from Cisco documentation, each unit should mark the failover interface as down and there shouldn't be any failover. That's exactly how I want this setup to work.

View 5 Replies View Related

Cisco Firewall :: ASA5510 Active / Standby Failover Speed

May 11, 2011

I have just finished setting up two ASA5510s in Active/Standby Staeful failover, using the Management interface for both failover and state. Everything appears to be working well.Configurations were transferred and the "sh failover" on both accurately reports their status before and after a failing the active device.I monitored the inside IP with a continuous ping (using a Windows client) and noticed that there were usually two to three ping responses lost. Is this normal?

View 1 Replies View Related

Cisco Firewall :: Two 5505 Redundant With Active Standby Setup?

Oct 21, 2012

I have two 5505 ASA.  I would like to know can I make two 5505 failover redundant with active standby setup?

View 11 Replies View Related

Cisco Firewall :: IPS Modules In ASA5510 Active / Standby Pair

Feb 6, 2012

I am looking to add the IPS module to my ASA 5510's. I am contemplating only purchasing one module and placing it in the active ASA. I am willing to accept that in a failure scenario I will loose the IPS functionality until the primary ASA is recovered. I have not had a chance to talk to my SE to see if this is even possible. Has anyone attempted a deployment such as this? Will it work and is it supported?

View 3 Replies View Related

Cisco Security :: ASA 5545 - 8.6 - Active / Standby - License Upgrade

Feb 4, 2013

We are planning to upgrade the ASA license in an A/S pair by adding the ASA5500-SC-20= license. The ASA is 5545 and runs 8.6. According to documentation, after 8.3 version, the ASAs can share a license features and do not require the same license on both boxes. I run a test in GNS3 with 8.4(2) images and I saw that by adding the 'activation-key' command only on the primary unit did the job as the 'show activation-key' output shows. In order to be 100% sure would like to verify the following:

Putting the activation-key only on the primary unit is enough and there is no need to do anything elseIn case the primary unit is standby, again we have to put the actication-key command on the primary unit (I am asking this because the 'activation-key' command is not listed under the commands that are not replicated to the other unitk, but doesn't make sense to be replicated since the activation-key is 'tied' with the S/N of the device).

View 4 Replies View Related

Cisco Firewall :: 5505s - Secondary ASA Active And Primary Is On Standby

Dec 5, 2011

We have 2 ASA 5505s in a data center at a remote site.
 
Whilst troubleshooting another issue I noticed the below. I don't know much about fail over but this would suggest that the secondary ASA is active and the primary ASA is on standby.
 
if the primary is "active" then how come the secondary is the active ASA? I would have thought that once the primary ASA became active this would assume the "main" role".

[Code] .....

View 7 Replies View Related

Cisco Firewall :: ASA 5550 Transparent Active / Standby Configuration

Dec 20, 2012

I am in the process of adding a new ASA 5550 as a standby box to an existing ASA 5550 running on transparent mode. Both are on version ASA 8.0(4) and ASDM 6.2(1). I have set the new ASA 5550 to transparent mode. The configurations are the following for the HA: [code]My questions are the following:

1. The management ip address is different than the ip used for the failover link. Since the firewalls are on transparent mode, does the failover ip needs to be the same as the management ip address?
 
2. Does any other additional config is needed for HA to work for basic active/stand-by failover?
 
3. Which is the best method to add the second box without disrupting the active box?

View 3 Replies View Related

Cisco Firewall :: Can Upgrade Active / Standby Pair From 7.2(4) To 8.0(5)25 Directly

Jan 17, 2012

Can I upgrade Active/standby pair from 7.2(4) to 8.0(5)25 directly or need to upgrade to 8.0.2/4 first? Upgrade an Active/Standby Failover ConfigurationComplete these steps in order to upgrade two units in an Active/Standby failover configuration:Download the new software to both units, and specify the new image to load with the boot system command.Refer to Upgrade a Software Image and ASDM Image using CLI for more information.Reload the standby unit to boot the new image by entering the failover reload-standby command on the active unit as shown below:active#failover reload-standbyWhen the standby unit has finished reloading and is in the Standby Ready state, force the active unit to fail over to the standby unit by entering the no failover active command on the active unit.active#no failover activeNote: Use the show failover command in order to verify that the standby unit is in the Standby Ready state.Reload the former active unit (now the new standby unit) by entering the reload command:newstandby#reloadWhen the new standby unit has finished reloading and is in the Standby Ready state, return the original active unit to active status by entering the failover active command:newstandby#failover activeThis completes the process of upgrading an Active/Standby Failover pair.

View 10 Replies View Related

Cisco Firewall :: ASA 5520 Active And Standby Preempt Functionality

Aug 6, 2012

Is the preempt option available in active standby ASA firewall setup with single context...somewhere i have read that same is available in active-active setup or active/standby setup with multiple context.If i active the multiple context mode on product environnement with two ASA5520 in Active/Standby mode, what are the impacts on the the production?

View 1 Replies View Related

Cisco Firewall :: 3900 - Configuring Active / Standby With Dual ISP

Jan 12, 2013

1. We have Two 3900 Router on the core layer which are terminated with one ISP on one Router and Secondary ISP on Second Router.

2. Can we configure my ASA 5520 with Active/Standby termenating two IPS providers one on Active ASA 5520  and Other ISP  on Standby ASA 5520, so that when Active ISP fail ASA Secondary can become Active and send the Traffic throough Secandary ISP.
 
3. The reasion behind giveing Public IP on Firewall is to Terminate VPN on our Firewall i.e. SSL and IPSEC VPN.
  
Few Clarification If we can achive the above:
 
1. How will the DMZ Servicec nated with my Primary ISP on my Primary ASA will be routed when the Secondary ASA is acting as Active Firewall.

2. Can Web SSL and Client To Site IPSEC  VPN users access service  via the Secondary ISP- ASA when my Primary ASA and ISP is down.

View 7 Replies View Related

Cisco Firewall :: ASA 5540 - Active / Standby Failover Pair

Apr 13, 2011

I currently have two 5540's in an Active/Standby pair. The primary unit failed on February 12th, so the secondary ASA is now the active one. My question is this - we have made a lot of changes since February 12th and I am planning on fixing this failover issue over the weekend. Will the secondary (now active) FW sync it's config to the non-active FW, or will the failed FW sync it's out-of-date config - removing any changes that we've made in the last month or so.

View 1 Replies View Related

Cisco Firewall :: Active / Standby Fail Over Config On ASA5510

Apr 10, 2011

I have two ASA5510 configured in an active/standby failover configuration. Everything is working well, but I would like to remove DMZ2 as it is no longer needed. On my DMZ2 interface, I have removed the security level and the IP address and shutdown the interface. However, when I do a "show failover" DMZ2 is still showing up. I would like to remove it completely so that failover isn't even "monitoring" this interface. What command am I missing or what do I need to do to completely remove this interface from this "show failover" listing? [code]

View 7 Replies View Related

Cisco Firewall :: ASA 5520 Active / Standby Failover - IP Addressing?

Mar 15, 2011

I am getting ready to setup avtice/standby failover on our ASA 5520's and have run in to an issue.I currently only have one External IP address available. My Idea was to use a private/placeholder IP address for the standby external IP Address, will this cause any issues with the failover? I know I won't be able to access the secondary from the outside, but that is not an issue.

View 2 Replies View Related

Cisco Firewall :: Upgrade ASA 5520 In Active / Standby Configured From 7.2(4) To 8.3(1)

Oct 9, 2011

I have been asked to look at upgrading two 5520 ASA configured in a HA pair Active/Standby, from version 7.2(4) to version 8.3(1) to bring it in line with some other ASA firewalls in the organisation.
 
My question is can I simply upgrade straight from 7.2(4) to 8.3(1) or will I have to step the upgrade from 7.2(4) => 8.2(x) => 8.3(1)
 
Having read a few articles on the forums and the release notes I think I should be able to go from 7.2(4) => 8.3(1) .
 
The second part of my query is around the upgrade itself, having researched this a little there seems to be various views on how to go about upgrading a HA pair and I cannot find anything specific on the website.
 
The approach I am thinking of is simply as follows;

- upload images onto both firewalls in the HA pair
- On the standby from the CLI
clear configure boot

[Code].....

View 3 Replies View Related

Cisco Firewall :: ASA 5510 Dual ISP Active / Standby Fail Over

Apr 2, 2013

I have a dual ISP, 1 primary and 1 secondary terminated on fa0 and fa2 on our ASA respectively. ASA was configured so that, when the primary fails, the secondary kicks in.  [code]
 
It was until yesterday that we experienced downtime on the primary ISP that the secondary doesn't do the fail-over. I have to manually configure the device to use the secondary ISP. Currently, I'm looking at maybe this has something to do with the licensing.We are currently using a Base License, should we be upgrading to Security Plus?

View 10 Replies View Related

Cisco Firewall :: SSM-4GE Module Installation On Active And Standby Firewalls

Jul 23, 2011

We are planning to install a new SSM-4GE module on both Active and Standby firewalls. how can we install an new SSM-4GE with a minimum outage. I was planning to install the module in the following steps.
 
1. Power off the secondary firewall(FW02).
2. Install a new module.
3. Power up the secondary firewall
4. Power off the primary firewall(FW01)---> in this step will the secondat firewall become active as there is a hardware conflict.
5. Install a new module.
6. Power up the Primary firewall(FW01)
 
or do i need to power down both the firewalls and then install the modules?i have is that after the installation only one port on the new SSM-4GE module would be in use on Primary firewall(FW01) which is a terminating link from a router. No link would be terminating on the new SSM-4GE module on secondary firewall. Will the firewalls still fail over in this case or does it require a link going to the secondary firewall on new SSM-4GE module(same port as on primary firewall) from the router.

View 4 Replies View Related

Cisco Firewall :: 6500 FWSM Active / Standby In VSS Mode

May 10, 2012

i do have two 6500 in VSS mode , and one FWSM module on each 6500, i want to configure these modules as Active/Standby, how do i start , should i  follow this (not in VSS mode): url..

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved