Cisco ASA goes down on Failover

richa_arya

Hi,

We have an NPM 12.3 HA environment.

While testing HA failover, noticed that some of Cisco ASA devices goes down.

The network parameters have been validated with the devices and the secondary server.

If anybody had faced similar issues , please help in resolving this as well.

Thanks and Regards

Richa Arya

yaquaholic

I have seen similar problems, where the HA vIP new MAC address isn't updated in the device's ARP cache. This means that when the ICMP poll comes into the device it resolves it to the incorrect MAC address and the ICMP poll fails.

Fire up a packet capture ((Wireshark) and you will be able to prove or disprove, if this is also happening to you.

If this is the problem, you can create a HA alert to run an executable, then get yourself a copy of arping.exe (windows binary) and ensure that the ASA gets a good flood of ARP packets to refresh its cache.

We have also seen CheckPoint HA devices doing very similar things, however the fix for these was to poll the two IPs under the HA and then UDP poll for their HA status.