ASA Failover Pair - SNMP and ICMP issue to the passive box
I have a pair of ASA5520's configured as active/passive failover to each other.
I have an NMS at my head office which has a VPN connection to the ASA pair. My NMS is able to ping the active box and pass SNMP back and forth with no issues, but it can't do the same to the passive box - SNMP and Ping both fail.
As the boxes both in essence have the same config running, is there something I'm missing that needs to be done to allow SNMP and Ping to work to both ASA's ??
TIA
Rob
I have an NMS at my head office which has a VPN connection to the ASA pair. My NMS is able to ping the active box and pass SNMP back and forth with no issues, but it can't do the same to the passive box - SNMP and Ping both fail.
As the boxes both in essence have the same config running, is there something I'm missing that needs to be done to allow SNMP and Ping to work to both ASA's ??
TIA
Rob
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for the replies.
We have an IPSec L2L tunnel between the two sites. The tunnel is up constantly as the NMS monitors several devices at the remote site where the two ASAs are located, so I know that the tunnel itself is working and, as the two ASAs are on the same subnet, there should (in theory) be no issues getting to the secondary ASA.
The NMS is pointed at the IP address for both ASAs but can only get responses from the primary.
We have an IPSec L2L tunnel between the two sites. The tunnel is up constantly as the NMS monitors several devices at the remote site where the two ASAs are located, so I know that the tunnel itself is working and, as the two ASAs are on the same subnet, there should (in theory) be no issues getting to the secondary ASA.
The NMS is pointed at the IP address for both ASAs but can only get responses from the primary.
But if the passive devices routing table expects to use its own tunnel and it is not up that would be the issue. Currently the primary tunnel is up. One the passive firewall try to do a traceroute to the NMC. Check the routing. I know that the tunnel is good, just wondering if the passive device is trying to create its own tunnel to route back.
ASKER
Thanks for clarifying Carlson. I'll take a look at that.
Did you find anything?
What did you see?
ASKER
HE is holiday and as soon as he comes back i am sure he will tets and update for yourself......just thought I would update you....
ASKER
Sorry for the delay.
I have tried traceroute from the primary ASA, just to see what I get on the box that is working, but there doesn't seem to be a traceroute command on the ASA.
Instead I tried to ping the NMS from the primary ASA, but the ping fails. I can ping devices on the ASA subnets with no issues, but I can't ping devices on the remote end of the VPN.
I can ping devices on the remote end of the VPN from devices that are behind the ASA with no issues. I just can't ping them from the ASA itself.
I have tried traceroute from the primary ASA, just to see what I get on the box that is working, but there doesn't seem to be a traceroute command on the ASA.
Instead I tried to ping the NMS from the primary ASA, but the ping fails. I can ping devices on the ASA subnets with no issues, but I can't ping devices on the remote end of the VPN.
I can ping devices on the remote end of the VPN from devices that are behind the ASA with no issues. I just can't ping them from the ASA itself.
ASKER
A little more info.....
The behaviour in my last update is the same from both ends of the VPN. On the PIX at the remote end I can't ping devices behind the ASA, but I can ping them from devices behind the PIX.
The behaviour in my last update is the same from both ends of the VPN. On the PIX at the remote end I can't ping devices behind the ASA, but I can ping them from devices behind the PIX.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
3nerds