2 Replies Latest reply on Jun 26, 2018 6:56 AM by yaquaholic

    Cisco ASA goes down on Failover

    richa arya

      Hi,

       

      We have an NPM 12.3 HA environment.

      While testing HA failover, noticed that some of Cisco ASA devices goes down.

       

      The network parameters have been validated with the devices and the secondary server.

       

      If anybody had faced similar issues , please help in resolving this as well.

       

      Thanks and Regards

      Richa Arya

        • Re: Cisco ASA goes down on Failover
          dodo123

          I dont have HA but has snmp been allowed on the ASA for connections from both servers?

           

          Just not sure if this has happened for a while and your just noticing that it didnt work on this release.

           

          ta

          • Re: Cisco ASA goes down on Failover
            yaquaholic

            I have seen similar problems, where the HA vIP new MAC address isn't updated in the device's ARP cache. This means that when the ICMP poll comes into the device it resolves it to the incorrect MAC address and the ICMP poll fails.

            Fire up a packet capture ((Wireshark) and you will be able to prove or disprove, if this is also happening to you.

            If this is the problem, you can create a HA alert to run an executable, then get yourself a copy of arping.exe (windows binary) and ensure that the ASA gets a good flood of ARP packets to refresh its cache.

             

            We have also seen CheckPoint HA devices doing very similar things, however the fix for these was to poll the two IPs under the HA and then UDP poll for their HA status.