Failover ASA

I am trying to setup a pair of ASA5510's in an active/passive failover.  When I issue the failover command from the secondary 5510 I see these messages

 

Detected an Active mate
Beginning configuration replication from mate.
Warning: no actions specified. All actions disabled.
Warning: no actions specified. All actions disabled.
End configuration replication from mate.

When I use "show failover | include host"  I see this
  This host: Secondary - Failed
  Other host: Primary - Active


The secondary node seems to have all the configuration from the primary.  At the time the primary had a few VPN connections active.  Those too seemed to be reflected on the secondary.  I think the status of the secondary node needs to be "Standby Ready".  Both are running ios V 9.1(5(21). Can anyone tell me where I went wrong or how to troubleshoot this?

e0/0 is the outside interface
e0/1 is the inside interface
e0/2 and e0/3 are the common ports

 

Below are the commands I used to setup failover on the two nodes.  Outside IP addresses are fictional.
On Primary node

interface Ethernet0/0
 mac-address 0003.000b.0001 standby 0003.000b.0002
 nameif outside
 security-level 0
 ip address 18.174.151.249 255.255.255.0 standby 18.174.151.152
!

interface Ethernet0/1
 mac-address 0003.000a.0001 standby 0003.000a.0002
 nameif inside
 security-level 100
 ip address 172.16.190.249 255.255.255.0 standby 172.16.190.149
 

interface Redundant1
 description LAN/STATE Failover Interface
 member-interface Ethernet0/2
 member-interface Ethernet0/3
 
failover
failover lan unit primary
failover lan interface FailoverLink Redundant1
failover polltime unit msec 200 holdtime msec 800
failover polltime interface msec 500 holdtime 5
failover link FailoverLink Redundant1
failover interface ip FailoverLink 192.168.168.173 255.255.255.252 standby 192.168.168.174


On Secondary Node

Interface e0/2
No shut
Interface e0/3
No shut

Interface Redundant 1
 Member-interface et 0/2
 Member-interface et 0/3

Failover lan unit secondary
Failover lan interface FailoverLink Redundant1
failover interface ip FailoverLink 192.168.168.173 255.255.255.252 standby 192.168.168.174
failover
LVL 1
labdunnAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jan SpringerCommented:
are the interfaces e0/2, e0/3 and redundant1 up?
0
Pete LongTechnical ConsultantCommented:
^^ agreed post the full output of 'show failover' from the standby firewall. Either an interface is down, or theres a failure that's putting it in a failed state.

P
0
labdunnAuthor Commented:
e0/2 and e/3 are both connected to each other by a 1' jumper cable.  Here's the results of show failover state.

show failover state

               State          Last Failure Reason      Date/Time
This host  -   Primary
               Active         None
Other host -   Secondary
               Failed         Ifc Failure              13:46:10 MST Jun 12 2015
                              outside: No Link
                              inside: No Link

====Configuration State===
        Sync Done
====Communication State===
        Mac set


I'm not certain what I'm reading  but it seems like it could be telling me the outside and inside interfaces of the secondary ASA are not connected?  Both ASA were put in the rack and cabled by another person.  I'm not certain they are properly connected.  I'm sure the link lights for the inside and outside interfaces were lit but I'm not certain they are in their proper vlans.  I won't be onsite for several days and won't be able to get any information from the secondary probably until next week.
0
Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

Jan SpringerCommented:
right, but i'd like to see the interface state.  are all three interfaces up?  two of them?

do you have remote access?
0
labdunnAuthor Commented:
I have access to the primary.  Attached is the results of show interface.

Tx

Bill
5510.txt
0
Jan SpringerCommented:
Have you first configured failover using a single physical interface or configured them as a port channel?  

Two interfaces in the same vlan assumes spanning tree and i don't believe that the 5510 supports STP.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
labdunnAuthor Commented:
I took one of the interfaces out of the failover group and the problem was corrected.  Thank you for your help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.