Doing a bit of research, it may be that you are running into a documented Cisco bug where you get the error “LU allocate xlate failed” on the standby device even through there is enough memory, as you are displaying in your output. The following link to the documentation of this specific bug states that an upgrade to the ASA software may be necessary:
When we talk about upgrading, we refer to the ASA Software version. In your screenshot, the software version is 8.4.2(2), and this is what must be upgraded. The Device Manager Version shown is that of the ASA ASDM which is used for GUI configuration of the ASA.
If you have a service contract with Cisco, you can download updated ASA software at the Cisco Software Download site.
What happens when 2 active asa’s units see each other? Let’s say i decouple my secondary standby unit from the network (without turning the device off), which in turn would cause it to become secondary active because it is decoupled. Now both asa’s are active. If i then re-attach the now secondary active unit to the network, will it become standby, or maintain active?
I have a pair of ASA in active / standby failover mode. My primary asa which was active became standby and the secondary became active. I would like to put in the right order, the primary becomes active again and vice versa. How do you do this without losing the connection?
The very last statement in the lesson answers your question. This statement says:
Active/standby failover does not use preemption. Once you enable the interface again, the currently active ASA will remain active.
This means that as soon as a failover takes place, once the standby ASA becomes active, it now plays the role of the primary ASA. If the first ASA comes back online, the roles are not automatically switched.
In order to return the active status to the original device, the simplest solution is to shutdown an interface on the currently active ASA that will cause a failure and will cause the other device to become active. Even though users shouldn’t perceive any network problems with such an event, it’s always best to perform this during low network traffic times or during maintenance windows.
When configuring the Active/Standby feature on two ASAs, you can specify which specific interfaces will be monitored. By specifying the interfaces, you can let the ASAs know what event will actually trigger the failover. This is done using the monitor-interface command as shown in the lesson.
So in order to see the Active/Standby failover in action, you must shutdown an interface that is being monitored by the feature. Otherwise, the failover will not be triggered.
If I have two ASAs (A/S) and the failover link fails, a switchover of roles would happen, right?
Eventhough the data interfaces see each other.
For example , the failover link fails but the INSIDE interfaces see each other.
The behavior of the pair of ASAs in an Active/Standby arrangement when various events take place, such as a failover link failure, can be found here:
Now it is possible to create multiple failover links between two ASAs, and it is best practice to use dedicated links for this purpose. However, it is possible to use the shared data interface as a failover link as well, if you have no more free interfaces. This is not recommended, as it can leave you vulnerable to replay attacks, and may also cause congestion due to large amounts of stateful traffic traversing the failover link. More information about how to create these multiple failover links, and the best practices to do so can be found here:
Also, take a look at the following Cisco documentation links on setting up multiple context mode as well as active/active failover.
Finally, if you’d like to suggest a new lesson on this topic, feel free to do so on the following Member Ideas page. There you may find that others have made similar suggestions and you can add your voice to theirs.
For failover, ASA devices don’t need to have the same license on each unit. However there are limitations as to what licenses should exist on both devices. Take a look at this CIsco documentation that details the licensing limitations for ASAs and failover:
In addition, the software version used in each ASA has some limitations. Both ASAs must have the same major (first number) and minor (second number) software version. So HA can be deployed on two ASAs with version numbers 8.4.1(11) and 8.4.3, but not on two ASAs with version numbers 8.4.1 and 8.6. This information can also be seen in the Cisco document shared above.
When creating an active/standby setup with Cisco ASAs, you don’t configure any addresses on the standby device. Indeed, the only thing you configure is the failover configuration, and the failover interface, which is the link between the two devices. In this lesson, the failover interface is the E0/3 interface on both devices.
Once that is done, the configuration will be replicated and sent to ASA2. Now we come to your question. When you issue the following command on ASA1:
ASA1(config-if)# ip address 192.168.1.254 255.255.255.0 standby 192.168.1.253
you are essentially telling the ASA2 what the IP address of its corresponding interface will be. When the configuration is replicated, you will see that the E0/0 interface of ASA2 will obtain the 192.168.1.253 IP address. It will also adopt the same subnet mask as that configured on ASA1.
Similarly, for the E0/1 interface, you will see that the 192.168.2.253 address is used for the ASA2.
Take a look at this Cisco ASA command reference for more information: