2

We have ASA 5585-X and i create back-to-back (without intermediate switch/hub) two 1G cable between two ASA to create failover + stateful link using g0/6 and g0/7 interface.

Interface config

!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
!
interface Redundant1
 description LAN/STATE Failover Interface
 member-interface GigabitEthernet0/6
 member-interface GigabitEthernet0/7
!

Failover config

failover
failover lan unit primary
failover lan interface FailoverLink Redundant1
failover polltime unit msec 200 holdtime msec 800
failover polltime interface msec 500 holdtime 5
failover link FailoverLink Redundant1
failover interface ip FailoverLink 192.168.100.1 255.255.255.0 standby 192.168.100.2

Everything working good but when i remove g0/6 cable to test Redundancy i am seeing error Secondary Failed in failover state command

asa-1/act/pri# sh failover state

               State          Last Failure Reason      Date/Time
This host  -   Primary
               Active         None
Other host -   Secondary
               Failed         Ifc Failure              12:34:14 UTC Sep 1 2017
                              outside: No Link
                              inside: No Link

====Configuration State===
        Sync Done
====Communication State===
        Mac set 

when i try to failover i got this error.

asa-1/act/pri# no failover active
WARNING: NO Standby detected in the network, or standby is in FAILED state.
Switching this unit to Standby can bring down the Network without any Active
So Abording Switchover.

here is the status of Redundant link

asa-1/act/pri# sh int redundant1
Interface Redundant1 "FailoverLink", is up, line protocol is up
  Hardware is bcm56801 rev 01, BW 1000 Mbps, DLY 10 usec
        Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
        Input flow control is unsupported, output flow control is off
        Description: LAN/STATE Failover Interface
        MAC address 4055.3980.0458, MTU 1500
        IP address 192.168.100.1, subnet mask 255.255.255.0
        8427 packets input, 756122 bytes, 0 no buffer
        Received 4 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 pause/resume input
        0 L2 decode drops
        0 switch ingress policy drops
        8604 packets output, 910986 bytes, 0 underruns
        0 pause/resume output
        0 output errors, 0 collisions, 0 interface resets
        0 late collisions, 0 deferred
        0 rate limit drops
        0 switch egress policy drops
        0 input reset drops, 0 output reset drops
  Traffic Statistics for "FailoverLink":
        8436 packets input, 604402 bytes
        8615 packets output, 756668 bytes
        0 packets dropped
      1 minute input rate 9 pkts/sec,  659 bytes/sec
      1 minute output rate 9 pkts/sec,  830 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 9 pkts/sec,  659 bytes/sec
      5 minute output rate 9 pkts/sec,  821 bytes/sec
      5 minute drop rate, 0 pkts/sec
  Redundancy Information:
        Member GigabitEthernet0/7(Active), GigabitEthernet0/6
        Last switchover at 12:33:37 UTC Sep 1 2017
  • It's just telling you the second ASA has failed. It failed because you unplugged of. IFC Failure is interface failure. No fail over active is because you have only 1 ASA active at the time. The syntax "or standby is in failed state" is because you pulled the cable and it's in the failed state. Which error exactly are you worried about? It looks normal for a fail over state with no other redundant ASAs available. – Fixitrod Sep 2 '17 at 2:19
  • I have two physical interface in Redundent1 interface and if I kill or unplug one it shouldn't cause any issue but in my case it break failover and now I can't failover from primary to standby you can see my command when I try to do failover it throwing errors – Satish Sep 2 '17 at 5:41
3

"Everything working good but when i remove g0/6 cable..." --> Does this mean failover is working for you when g0/6 cable is plugged? Please plug back the cable and run the commands show failover and show failover state

I noticed that outside and inside interfaces on Standby ASA have No Link, this means the physical links for these interfaces on Standby ASA are down, causing the issue. Please check this.

  • Yes, inside and outside isn't plug in because right now this firewall in LAB for testing, Do i need to plug them in order to check full functionality of failover? I will try and update result. – Satish Sep 2 '17 at 14:09
  • There you go! "No link" interfaces are causing the failover issue, thus you cannot failover because your current unit is in better condition. Plug all the cables back and make sure they are up in correct VLANs, then try show failover and show failover state again on current active unit. If everything is okay you will see "Secondary - Standby Ready", meaning it is ready for you to failover.. Good luck! – Hung Tran Sep 2 '17 at 14:48
  • Ok! will update here my result soon, but last thing i heard somewhere if you using Redundent interface for Failover LAN + State Link they you should use switch/hub between to create broadcast domain, direct crossover cable won't work, is that true? – Satish Sep 2 '17 at 15:57
  • @Satish Have you had a change to test it out? Please update us! – Hung Tran Sep 11 '17 at 8:27
  • Yes! it works!!!!! sorry i forgot to update but here you go – Satish Sep 11 '17 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.