"Failover active" cannot change active/standby

Hi We have failover pair ASA 5555(ASA1 and ASA2). After we configured failover, we cannot switch active/standby by command failover active. When I use the command in ASA2(in standby status), it can only change Secondary status into Primary status. When I re-used the command, the Primary change back into Secondary, the standby status in ASA2 remain unchanged. Anyone can explain it ? Thank you
eemoonAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Luke SmithSenior Manager, Production EngineeringCommented:
Are you just using the command "failover active" or have you tried using "failover exec active"?
0
eemoonAuthor Commented:
Hi Thank you so much for your fast reply. I just used failover active. I did not use failover exec active
I can see "exec" means Execute command on the designated unit, what is this meaning exactly ?
0
pgolding00Commented:
"fail exec" is to execute a command on the active, the standby, or the partner with clarity about which device it will be executed on. its nothing to do with swapping between active and idle state on  the devices.

there are two different things here. when first configured, one appliance is designated as the  primary and the other as the secondary. the configuration references primary and secondary to determine which one has which ip address. these are the only config parameters that differ between the two devices:

xxx-asa# sh run fail (on primary)
failover
failover lan unit primary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.23.255.1 255.255.255.252 standby 172.23.255.2
xxx-asa# 

xxx-asa# fail exec st sh run fail			(on secondary)
failover
failover lan unit secondary
failover lan interface failover Ethernet0/3
failover link failover Ethernet0/3
failover interface ip failover 172.23.255.1 255.255.255.252 standby 172.23.255.2


xxx-asa# sh run int (primary)
!
interface Ethernet0/0
 speed 100
 duplex full
 nameif outside
 security-level 0
 ip address 203.x.x.106 255.255.255.248 standby 203.x.x.107
!
interface Ethernet0/1
 speed 100
 duplex full
 nameif inside
 security-level 100
 ip address 192.168.254.17 255.255.255.248 standby 192.168.254.18 
!
interface Ethernet0/2
 speed 100
 duplex full
 nameif dmz
 security-level 10
 ip address 203.x.x.1 255.255.255.240 standby 203.x.x.14 
!
interface Ethernet0/3
 description LAN/STATE Failover Interface
!


xxx-asa# fail exec st sh run int  (secondary)
!
interface Ethernet0/0
 speed 100
 duplex full
 nameif outside
 security-level 0
 ip address 203.x.x.106 255.255.255.248 standby 203.x.x.107
!
interface Ethernet0/1
 speed 100
 duplex full
 nameif inside
 security-level 100
 ip address 192.168.254.17 255.255.255.248 standby 192.168.254.18 
!
interface Ethernet0/2
 speed 100
 duplex full
 nameif dmz
 security-level 10
 ip address 203.x.x.1 255.255.255.240 standby 203.x.x.14 
!
interface Ethernet0/3
 description LAN/STATE Failover Interface
!

Open in new window



then there is the status of each device. in single context mode, one will be active and the other will be standing by. for multi-context, some contexts can be active on one device and other contexts active on the other.

xxx-asa# sh fail
Failover On 
Failover unit Primary
Failover LAN Interface: failover Ethernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 110 maximum
Version: Ours 8.2(5)46, Mate 8.2(5)46
Last Failover at: 15:12:27 WST Nov 28 2013
	This host: Primary - Active 
		Active time: 54509227 (sec)
		slot 0: ASA5510 hw/sw rev (2.0/8.2(5)46) status (Up Sys)
		  Interface outside (203.x.x.106): Normal
		  Interface inside (192.168.254.17): Normal 
		  Interface dmz (203.x.x.1): Normal 
		slot 1: empty
	Other host: Secondary - Standby Ready 
		Active time: 183732 (sec)
		slot 0: ASA5510 hw/sw rev (2.0/8.2(5)46) status (Up Sys)
		  Interface outside (203.x.x.107): Normal
		  Interface inside (192.168.254.18): Normal 
		  Interface dmz (203.x.x.14): Normal 
		slot 1: empty


xxx-asa# fail exec st sh fail
Failover On 
Failover unit Secondary
Failover LAN Interface: failover Ethernet0/3 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 110 maximum
Version: Ours 8.2(5)46, Mate 8.2(5)46
Last Failover at: 15:12:16 WST Nov 28 2013
	This host: Secondary - Standby Ready 
		Active time: 183732 (sec)
		slot 0: ASA5510 hw/sw rev (2.0/8.2(5)46) status (Up Sys)
		  Interface outside (203.x.x.107): Normal
		  Interface inside (192.168.254.18): Normal 
		  Interface dmz (203.x.x.14): Normal 
		slot 1: empty
	Other host: Primary - Active 
		Active time: 54509238 (sec)
		slot 0: ASA5510 hw/sw rev (2.0/8.2(5)46) status (Up Sys)
		  Interface outside (203.x.x.106): Normal
		  Interface inside (192.168.254.17): Normal 
		  Interface dmz (203.x.x.1): Normal 
		slot 1: empty

Open in new window


in these example devices above, the device designated primary is active and the secondary is standby. its quite possible that the primary be standby and the secondary is active.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
eemoonAuthor Commented:
Excellent! Thank you.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.