Cisco ASA connection table in ACTIVE/STBY scenerio

[CCOCNSC21]

Hi All,

Recently during IOS upgrade in Cisco ASA pair (active/stby), users experienced partial outage after I failed over the traffic to secondary ASA, while upgrading the primary. Basically connection table didnt get replicated completly. So how to check whether the connection table get fully converged after the upgrade ?

I failed the traffic to secondary from ACTIVE unit using "no failover active" after saw following message and thought connection table get  replicated as well. But it wasnt.

************WARNING****WARNING****WARNING********************************
Beginning configuration replication: Sending to mate.
ASA/act#
ASA/act# End Configuration Replication to mate, peer taking too long to move to

standby state.

ASA/act# sh failover state

               State          Last Failure Reason      Date/Time
This host  -   Secondary
               Active         None
Other host -   Primary
               Standby Ready  Comm Failure             22:20:57 EST Jul 30 2018

====Configuration State===
        Sync Done
        Sync Done - STANDBY
====Communication State===
        Mac set

[johnlloyd_13]

hi,

you can issue a show conn to view state table on the ASA.

it's also wise to perform an ASA code upgrade in a maintenance window so end users are informed and covered for any disruptions.

also try to use the failover replication http command.

[Jason Gervia]

Do you have the output from a 'show run failover' command?

[CCOCNSC21]

ASA/act# sh running-config failover
failover
failover lan unit secondary
failover lan interface failover Vlan604
failover polltime unit msec 200 holdtime msec 800
failover polltime interface 1 holdtime 5
failover replication http
failover link statelink Vlan605
failover interface ip failover X.X.90.65 255.255.255.252 standby X.X.90.66
failover interface ip statelink X.X.90.5 255.255.255.252 standby X.X.90.6
ASA/act#

ASA/stby# sh running-config failover
failover
failover lan unit primary
failover lan interface failover Vlan604
failover polltime unit msec 200 holdtime msec 800
failover polltime interface 1 holdtime 5
failover replication http
failover link statelink Vlan605
failover interface ip failover X.X.90.65 255.255.255.252 standby X.X.90.66
failover interface ip statelink X.X.90.5 255.255.255.252 standby X.X.90.6
ASA/act#