Cisco ASA 5525X to Version 9.4.1. How?
Failover problem on Cisco ASA 5525x after upgrade to version 9.4.1
A user of Cisco ASA 5525x shared his experience of Failover problem on Cisco ASA 5525x after upgrade to version 9.4.1. What’s his problem and how to solve the problem? Let’s have a look.
The man faced with problem after he has done upgrade from 8.6.1 to 9.4.1 on Cisco ASA 5525x with IPS software in Active/Standby configuration.
One of his customers asked him to upgrade to verion 9.4.1 his Active/Standby Cisco ASAs. The man read release notes for this version and started with upgrade. As mentioned in release notes he did upgrade to version 9.0.4 first. Upgrade finished without any problems! All interface were in monitoring state, failover was in perfect state, no errors no issues, everything was as should be. Then started with upgrade to required version 9.4.1. He did everything as before, download image and ASDM, changed boot config, and did failover reload-standby.
After standby unit rebooted he expected standby ready state. But state of standby unit was-Other host: Secondary-Failed
ASA-Firewall# show failover
Failover On
Failover unit Primary
Failover LAN Interface: failoverlink GigabitEthernet0/2 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 216 maximum
failover replication http
Version: Ours 9.0(4), Mate 9.4(1)
Last Failover at: 14:42:17 AZDT Jun 5 2015
This host: Primary - Active
Active time: 3542 (sec)
slot 0: ASA5525 hw/sw rev (1.0/9.0(4)) status (Up Sys)
Interface inside (10.34.10.254): Normal (Waiting)
Interface outside (xx.132.xx.xxx): Normal (Waiting)
Interface management (10.34.7.252): Normal (Waiting)
slot 1: IPS5525 hw/sw rev (N/A/7.1(9)E4) status (Up/Up)
IPS, 7.1(9)E4, Up
Other host: Secondary - Failed
Active time: 0 (sec)
slot 0: ASA5525 hw/sw rev (1.0/9.4(1)) status (Up Sys)
Interface inside (10.34.10.253): Unknown (Waiting)
Interface outside (xx.132.xx.xxx): Unknown (Waiting)
Interface management (10.34.7.251): Unknown (Waiting)
slot 1: UNKNOWN hw/sw rev (N/A/) status (Unresponsive)
He did investigtion, checked everything (e.g. interface, config, show commands and so on). He was confused how it can be, he did upgrade till version 9.0.4 for 5 minutes but on version 9.4.1 I stuck. After more deep investigation he thought he found the reason of this problem. He connected to active and standby unit and execute comand:
On Standby ASA-Firewall# show module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
0 ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC ASA5525 FCH18037CSR
ips ASA 5525-X IPS Security Services Processor ASA5525-IPS FCH18037CSR
cxsc Unknown N/A FCH18037CSR
sfr Unknown N/A FCH18037CSR
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
0 18e7.282e.8bbd to 18e7.282e.8bc6 1.0 2.1(9)8 9.4(1)
ips 18e7.282e.8bbb to 18e7.282e.8bbb N/A N/A 7.1(9)E4
cxsc 18e7.282e.8bbb to 18e7.282e.8bbb N/A N/A
sfr 18e7.282e.8bbb to 18e7.282e.8bbb N/A N/A
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
ips IPS Up 7.1(9)E4
sfr Unknown No Image Present Not Applicable
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
0 Up Sys Not Applicable
ips Up Up
cxsc Unresponsive Not Applicable Not powered on completely
sfr Unresponsive Not Applicable
Mod License Name License Status Time Remaining
---- -------------- --------------- ---------------
ips IPS Module Enabled perpetual
AND THE SAME ON ACTIVE
On Active ASA-Firewall# show module
Mod Card Type Model Serial No.
--- -------------------------------------------- ------------------ -----------
0 ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC ASA5525 FCH17517QRK
ips ASA 5525-X IPS Security Services Processor ASA5525-IPS FCH17517QRK
Mod MAC Address Range Hw Version Fw Version Sw Version
--- --------------------------------- ------------ ------------ ---------------
0 3c08.f6d9.9278 to 3c08.f6d9.9281 1.0 2.1(9)8 9.0(4)
ips 3c08.f6d9.9276 to 3c08.f6d9.9276 N/A N/A 7.1(9)E4
Mod SSM Application Name Status SSM Application Version
--- ------------------------------ ---------------- --------------------------
ips IPS Up 7.1(9)E4
Mod Status Data Plane Status Compatibility
--- ------------------ --------------------- -------------
0 Up Sys Not Applicable
ips Up Up
Mod License Name License Status Time Remaining
--- -------------- --------------- ---------------
ips IPS Module Enabled perpetual
We know that ASA failover algorithm do a lot of ckecks and one of this check is to monitor modules. As we can see on the output after upgrade to version 9.4.1 NEW module appears on standby unit: cxsc and sfr as we can see. On Active unit there are no such modules. May be standby unit can’t check the state, or Active unit cant interpret standby unit messages, I dont know realy (
He had questions:
1) Why this new modues appeared, for what for, how they work...?
2) Can I upgrade my Cisco ASAs till that version?
3) What I shuld do to upgrdade? I need this upgrade very much, because I need Policy Based Routing functionality?
4) Can I do upgrade without interruption ?
Someone solved it and answered like this: “Yes, complete your upgrade on the active unit and it will show the same unknown status for the cxsc and sfr modules. Once you do that successfully, you should have a healthy HA pair.
Support for cxsc and sfr as module types was introduced in versions 9.1(1) and 9.2(2) respectively.
You can stick with your ips (classic IPS module) as long as it's meeting your needs. It is end of sales now (as is the CX module shortly) and both are deprecated in favor of the newer "sfr" or FirePOWER module. More about FirePOWER is on the product data sheet (and elsewhere).”
What’s your ideas, welcome to share here…
…
The Case From https://supportforums.cisco.com/discussion/12526776/failover-problem-cisco-asa-5525x-after-upgrade-version-941
More Related
Cisco ASA 5506-X with Version 9.4.1–Policy Based Routing
What are the Considerations While Buying a Cisco Next-Generation Firewall?
…