Troubleshooting Cisco ASA Firewall Active-Standby Failover

I was configuring a new pair of Cisco ASA 5555-X and tried to make failover work. I tried removing the failover pre-shared key, used the failover ipsec pre-shared key <KEY> command, re-configured failover on both the Primary and Secondary firewalls and re-configured the Secondary firewall from scratch but no luck.

It kept looping with the error: "REPLICATION OF CONFIGURATION FROM ACTIVE TO STANDBY UNIT IS INCOMPLETE, TO PREVENT THE STANDBY UNIT TAKING OVER AS ACTIVE WITH A PARTIAL CONFIGURATION,THE STANDBY UNIT WILL NOW REBOOT"

ciscoasa#    // SECONDARY FW
Beginning configuration replication from mate.   

ciscoasa# show interface ip brief

Interface                  IP-Address      OK? Method Status                Protocol

GigabitEthernet0/0         unassigned      YES unset  up                    up 

GigabitEthernet0/1         unassigned      YES unset  up                    up 

GigabitEthernet0/2         unassigned      YES unset  administratively down down

GigabitEthernet0/3         unassigned      YES unset  administratively down down

GigabitEthernet0/4         unassigned      YES unset  administratively down down

GigabitEthernet0/5         unassigned      YES unset  administratively down down

GigabitEthernet0/6         unassigned      YES unset  administratively down down

GigabitEthernet0/7         192.168.1.1     YES unset  up                    up 

Internal-Control0/0        127.0.1.1       YES unset  up                    up 

Internal-Data0/0           unassigned      YES unset  up                    up 

Internal-Data0/1           unassigned      YES unset  down                  down

Internal-Data0/2           unassigned      YES unset  up                    up 

Internal-Data0/3           169.254.1.1     YES unset  up                    up 

Management0/0              unassigned      YES unset  up                    up 

ciscoasa#

******REPLICATION OF CONFIGURATION FROM ACTIVE TO STANDBY UNIT IS INCOMPLETE,

 TO PREVENT THE STANDBY UNIT TAKING OVER AS ACTIVE WITH A PARTIAL CONFIGURATION,

 THE STANDBY UNIT WILL NOW REBOOT*******

             

Link : Unconfigured.

INFO: FirePower module is detected running.  ASA will be reloaded gracefully.

***

*** --- SHUTDOWN NOW ---

***

*** Message to all terminals:

***

***   failover reset

Process shutdown finished

Rebooting... (status 0x9)

..

INIT: Sending processes the TERM signal

Deconfiguring network interfaces... done.

Sending all processes the TERM signal...

ciscoasa/pri/act# show run failover

failover

failover lan unit primary

failover lan interface FAILOVER GigabitEthernet0/7

failover key *****

failover replication http

failover interface ip FAILOVER 192.168.1.1 255.255.255.252 standby 192.168.1.2

I noticed a high rate of ping drops towards the Secondary failover IP and also a high input and CRC errors, which indicates a Layer 1 (cable) issue. So I swapped the failover (straight) cable between the firewall pair and the Secondary firewall started to sync its config with the Primary firewall.

ciscoasa/pri/act# ping 192.168.1.2 rep 100

Type escape sequence to abort.

Sending 100, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

!?!????!?!!??!???!!??!!????!?!!?!!????!????!???!???!????!?!!????!?!???

!!!?!?

Success rate is 36 percent (28/76), round-trip min/avg/max = 1/1/1 ms

ciscoasa/pri/act# show interface g0/7   // HIGH INPUT AND CRC ERRORS DETECTED                           

Interface GigabitEthernet0/7 "FAILOVER", is up, line protocol is up

  Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec

        Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)

        Input flow control is unsupported, output flow control is off

        Description: LAN Failover Interface

        MAC address 5087.89b7.5593, MTU 1500

        IP address 192.168.1.1, subnet mask 255.255.255.252

        1058 packets input, 119647 bytes, 0 no buffer

        Received 114 broadcasts, 0 runts, 0 giants

        830 input errors, 830 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

        0 pause input, 0 resume input

        0 L2 decode drops

        1373 packets output, 304203 bytes, 0 underruns

        0 pause output, 0 resume output

        0 output errors, 0 collisions, 9 interface resets

        0 late collisions, 0 deferred

        0 input reset drops, 0 output reset drops

        input queue (blocks free curr/low): hardware (487/461)

        output queue (blocks free curr/low): hardware (453/446)

  Traffic Statistics for "FAILOVER":

        566 packets input, 67308 bytes

        695 packets output, 204164 bytes

        0 packets dropped

      1 minute input rate 2 pkts/sec,  279 bytes/sec

      1 minute output rate 1 pkts/sec,  640 bytes/sec

      1 minute drop rate, 0 pkts/sec

      5 minute input rate 0 pkts/sec,  64 bytes/sec

      5 minute output rate 1 pkts/sec,  304 bytes/sec

      5 minute drop rate, 0 pkts/sec

Troubleshooting the Secondary (Standby) firewall:

ciscoasa# show run failover

failover

failover lan unit secondary

failover lan interface FAILOVER GigabitEthernet0/7

failover key *****

failover replication http

failover interface ip FAILOVER 192.168.1.1 255.255.255.252 standby 192.168.1.2

ciscoasa# show interface g0/7 

Interface GigabitEthernet0/7 "FAILOVER", is up, line protocol is up

  Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec

        Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)

        Input flow control is unsupported, output flow control is off

        Description: LAN Failover Interface

        MAC address f40f.1b1e.1405, MTU 1500

        IP address 192.168.1.2, subnet mask 255.255.255.252

        277 packets input, 45654 bytes, 0 no buffer

        Received 26 broadcasts, 0 runts, 0 giants

        193 input errors, 193 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

        0 pause input, 0 resume input

        0 L2 decode drops

        992 packets output, 138768 bytes, 0 underruns

        0 pause output, 0 resume output

        0 output errors, 0 collisions, 4 interface resets

        0 late collisions, 0 deferred

        3 input reset drops, 0 output reset drops

        input queue (blocks free curr/low): hardware (503/461)

        output queue (blocks free curr/low): hardware (492/447)

  Traffic Statistics for "FAILOVER":

        274 packets input, 40530 bytes

        992 packets output, 120192 bytes

        0 packets dropped

      1 minute input rate 1 pkts/sec,  255 bytes/sec

      1 minute output rate 4 pkts/sec,  519 bytes/sec

      1 minute drop rate, 0 pkts/sec

      5 minute input rate 0 pkts/sec,  0 bytes/sec

      5 minute output rate 0 pkts/sec,  0 bytes/sec

      5 minute drop rate, 0 pkts/sec

ciscoasa# Failover LAN became OK

Switchover enabled

Configuration has changed, replicate from mate.

..

        Detected an Active mate

Beginning configuration replication from mate.

WARNING: Local user database is empty and there are still 'aaa' commands for 'LOCAL'.

ciscoasa/sec/stby# End configuration replication from mate.

Cisco ASA 5500-X Password Recovery in Multiple Context Mode

Here's the link for doing a password recovery procedure on different Cisco ASA firewall platform. There's a slight difference between the ASA5500 first-gen firewall and ASA5500-X series (where you type Yes). This is the password recovery which I performed on a Cisco ASA55555-X in Multiple Context mode.

ciscoasa/pri/act(config)# changeto context admin
ciscoasa/pri/act/admin(config)# show run
Command authorization failed


You need to disable failover under the system context on each firewall to prevent the configuration from being synchronized and just focus troubleshooting on the Primary unit.

ciscoasa/sec/stby(config)# no failover

ciscoasa/pri/act(config)# no failover
ciscoasa/pri/actNoFailover(config)# write memory      // SAVE CONFIG


Reboot the ASA either by issuing reload under system context or press and hold the power button on the appliance. Press Escape (Esc beside F1 key) to go into ROMMON mode.

Use BREAK or ESC to interrupt boot.

Use SPACE to begin boot immediately.

Boot in 10 seconds.
                                          

Boot interrupted.

Management0/0
Link is UP
MAC Address: 84b2.6191.1234


Use ? for help.
rommon #0> confreg

Current Configuration Register: 0x00000001     // THIS THE NORMAL CONFIG REGISTER SETTING; WILL LOAD THE START UP CONFIG
Configuration Summary:
  boot default image from Flash

Do you wish to change this configuration? y/n [n]: n    // TYPE n FOR NO OR JUST PRESS ENTER TO ACCEPT DEFAULT VALUE

rommon #1> confreg 0x41      // THIS WILL BYPASS THE STARTUP-CONFIG

Update Config Register (0x41) in NVRAM...

rommon #2> confreg

Current Configuration Register: 0x00000041
Configuration Summary:
  boot default image from Flash
  ignore system configuration

Do you wish to change this configuration? y/n [n]: y     // TAKE NOTE OF THE YES
enable boot to ROMMON prompt? y/n [n]:  <PRESS ENTER TO ACCEPT DEFAULT VALUE>
enable TFTP netboot? y/n [n]:
enable Flash boot? y/n [n]:
select specific Flash image index? y/n [n]:
disable system configuration? y/n [n]: y
go to ROMMON prompt if netboot fails? y/n [n]:
enable passing NVRAM file specs in auto-boot mode? y/n [n]:
disable display of BREAK or ESC key prompt during auto-boot? y/n [n]:

Current Configuration Register: 0x00000041
Configuration Summary:
  boot ROMMON
  ignore system configuration

Update Config Register (0x41) in NVRAM...

rommon #4> boot     // REBOOT APPLIANCE
Launching BootLoader...
Boot configuration file contains 1 entry.


Loading disk0:/asa982-35-smp-k8.bin... Booting...
Platform ASA5555

Loading...

<SNIP>


This platform has an ASA5555 VPN Premium license.

Creating context 'system'... Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
                             Boot microcode        : CNPx-MC-BOOT-2.00
                             SSL/IKE microcode     : CNPx-MC-SSL-SB-PLUS-0005
                             IPSec microcode       : CNPx-MC-IPSEC-MAIN-0026
Done. (0)
Creating context 'null'... Done. (507)

Cisco Adaptive Security Appliance Software Version 9.8(2)35 <system>

  ****************************** Warning *******************************
  This product contains cryptographic features and is
  subject to United States and local country laws
  governing, import, export, transfer, and use.
  Delivery of Cisco cryptographic products does not
  imply third-party authority to import, export,
  distribute, or use encryption. Importers, exporters,
  distributors and users are responsible for compliance
  with U.S. and local country laws. By using this
  product you agree to comply with applicable laws and
  regulations. If you are unable to comply with U.S.
  and local laws, return the enclosed items immediately.

  A summary of U.S. laws governing Cisco cryptographic
  products may be found at:
  http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

  If you require further assistance please contact us by
  sending email to export@cisco.com.
  ******************************* Warning *******************************
Cisco Adaptive Security Appliance Software, version 9.8
Copyright (c) 1996-2018 by Cisco Systems, Inc.
For licenses and notices for open source software used in this product, please visit
http://www.cisco.com/go/asa-opensource

                Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

                Cisco Systems, Inc.
                170 West Tasman Drive
                San Jose, California 95134-1706

Ignoring the rest of the file
Ignoring startup configuration as instructed by configuration register.

INFO: Power-On Self-Test in process.
.......................................................................
INFO: Power-On Self-Test complete.

INFO: Starting HW-DRBG health test...
INFO: HW-DRBG health test passed.

INFO: Starting SW-DRBG health test...
INFO: SW-DRBG health test passed.
User enable_1 logged in to ciscoasa
Logins over the last 1 days: 1. 
Failed logins since the last login: 0. 
Type help or '?' for a list of available commands.

ciscoasa> enable      // ASA WILL LOAD A BLANK OR DEFAULT CONFIG
Password: <ENTER>

ciscoasa# show run
: Saved

:
: Serial Number: FCH19391234
: Hardware:   ASA5555, 16384 MB RAM, CPU Lynnfield 2792 MHz, 1 CPU (8 cores)
:
ASA Version 9.8(2)35 <system>    // YOU'LL BE IN SYSTEM CONTEXT
!
hostname ciscoasa
enable password $sha512$5000$4WmfnCPFaydT+Fowjif0Cg==$ORJElavY7LebyP0cYjYmhQ== pbkdf2
no mac-address auto
!
interface GigabitEthernet0/0
 shutdown
!
interface GigabitEthernet0/1
 shutdown
!
interface GigabitEthernet0/2
 shutdown
!
interface GigabitEthernet0/3
 shutdown
!
interface GigabitEthernet0/4
 shutdown
!
interface GigabitEthernet0/5
 shutdown
!
interface GigabitEthernet0/6
 shutdown
!
interface GigabitEthernet0/7
 shutdown
!
interface Management0/0
 shutdown
!
class default
  limit-resource All 0
  limit-resource Mac-addresses 65536
  limit-resource ASDM 5
  limit-resource SSH 5
  limit-resource Telnet 5
!
ftp mode passive
pager lines 24
no failover
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 32768
ssh stricthostkeycheck
console timeout 0
!
tls-proxy maximum-session 1000
!
prompt hostname context
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:00000000000000000000000000000000
: end


ciscoasa# copy startup-config running-config      // LOAD THE STARTUP-CONFIG
Destination filename [running-config]?

.INFO: Non-failover interface config is cleared on GigabitEthernet0/7 and its sub-interfaces
INFO: Admin context is required to get the interfaces
INFO: Admin context is required to get the interfaces
INFO: Admin context is required to get the interfaces
Creating context 'admin'... Done. (1)
...
Cryptochecksum (unchanged): 3e88bc1b fd82b3a9 6ee910d2 343ce7ef
INFO: Context admin was created with URL disk0:/admin.cfg        
INFO: Admin context will take some time to come up .... please wait.    // ASA WILL LOAD THE admin AND OTHER CONFIGURED CONTEXTS

ciscoasa/pri/act# .

    No Active mate detected

ciscoasa/pri/act# configure terminal
ciscoasa/pri/act(config)# no failover     // DISABLE FAILOVER AND OVERWRITE PASSWORDS
ciscoasa/pri/actNoFailover(config)#
ciscoasa/pri/actNoFailover(config)# aaa-server ISE protocol tacacs+
ciscoasa/pri/actNoFailover(config)# aaa-server ISE (management) host 192.168.1.100
ciscoasa/pri/actNoFailover(config)# key cisco123
ciscoasa/pri/actNoFailover(config)# username enable_15 password cisco privilege 15   // THIS IS A LOCAL USER FALLBACK WHEN GETTING THE ERROR:  
Username 'enable_15' not in LOCAL database
Command authorization failed
ciscoasa/pri/actNoFailover(config)# aaa authentication ssh console ISE LOCAL
ciscoasa/pri/actNoFailover(config)# aaa authentication enable console ISE LOCAL
ciscoasa/pri/actNoFailover(config)# aaa authentication http console ISE LOCAL
ciscoasa/pri/actNoFailover(config)# aaa authentication serial console ISE LOCAL
ciscoasa/pri/actNoFailover(config)# aaa accounting command ISE
ciscoasa/pri/actNoFailover(config)# aaa authorization exec authentication-server auto-enable   // THIS WILL BYPASS TYPING enable AND GO DIRECTLY TO  PRIVILEGE EXEC MODE
ciscoasa/pri/actNoFailover(config)# aaa authorization command ISE LOCAL
ciscoasa/pri/actNoFailover/admin(config)# sh run aaa
Command authorization failed      // TACACS+/AAA KICKED IN


admin@ciscoasa's password:      // SSH TO THE ASA
User admin logged in to ciscoasa
Logins over the last 1 days: 1. 
Failed logins since the last login: 0. 
Type help or '?' for a list of available commands.

ciscoasa/pri/actNoFailover/admin#     // PROMPT GOES DIRECTLY TO PRIVILEGE EXEC
ciscoasa/pri/actNoFailover/admin# changeto system
ciscoasa/pri/actNoFailover# configure terminal     
ciscoasa/pri/actNoFailover(config)# no config-register    // REVERT TO ORIGINAL CONFIG REGISTER (0x1)
ciscoasa/pri/actNoFailover(config)# failover
ciscoasa/pri/act(config)# write memory     // SAVE CONFIFG
ciscoasa/pri/act(config)# show version

<SNIP>

Configuration register is 0x41 (will be 0x1 at next reload)

Image type          : Release
Key version         : A

Configuration last modified by enable_15 at 04:12:09.307 UTC Fri Mar 22 2019


<REBOOT ASA>


ciscoasa/pri/act/admin# show version

<SNIP>


This platform has an ASA5555 VPN Premium license.

Serial Number: FCH19391234
Running Permanent Activation Key: 0xca3de65c 0x28092655 0xa10195b8 0xd4887824 0x801b1234
Configuration register is 0x1

Removing Cisco ASA Firewall Security Context

To configure a Cisco ASA firewall Security Context, you'll need a Security Context License applied on the ASA. The maximum number of Security Contexts supported would depend on the ASA platform.

ciscoasa# configure terminal

ciscoasa(config)# activation-key 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0x8b48b8b0 0xf317c0b5

Validating activation key. This may take a few minutes...

Failed to retrieve permanent activation key.

Failover is different.

   running permanent activation key: Restricted(R)

   new permanent activation key: Unrestricted(UR)

WARNING: The running activation key was not updated with the requested key.

Proceed with update flash activation key? [confirm]

The flash permanent activation key was updated with the requested key,

and will become active after the next reload.

ciscoasa(config)#

ciscoasa(config)# show version

Cisco Adaptive Security Appliance Software Version 8.4(2)

Compiled on Wed 15-Jun-11 18:17 by builders

System image file is "Unknown, monitor mode tftp booted image"

Config file at boot was "startup-config"

ciscoasa up 5 mins 16 secs

Hardware:   ASA 5520, 1024 MB RAM, CPU Pentium II 1000 MHz

Internal ATA Compact Flash, 256MB

BIOS Flash unknown @ 0x0, 0KB

 0: Ext: GigabitEthernet0    : address is 0000.ab5a.d200, irq 0

 1: Ext: GigabitEthernet1    : address is 0000.ab5a.d201, irq 0

 2: Ext: GigabitEthernet2    : address is 0000.ab5a.d202, irq 0

 3: Ext: GigabitEthernet3    : address is 0000.ab5a.d203, irq 0

Licensed features for this platform:

Maximum Physical Interfaces       : Unlimited      perpetual

Maximum VLANs                     : 100            perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Disabled       perpetual

VPN-DES                           : Disabled       perpetual

VPN-3DES-AES                      : Disabled       perpetual

Security Contexts                 : 0              perpetual

GTP/GPRS                          : Disabled       perpetual

AnyConnect Premium Peers          : 5000           perpetual

AnyConnect Essentials             : Disabled       perpetual

Other VPN Peers                   : 5000           perpetual

Total VPN Peers                   : 0              perpetual

Shared License                    : Disabled       perpetual

AnyConnect for Mobile             : Disabled       perpetual

AnyConnect for Cisco VPN Phone    : Disabled       perpetual

Advanced Endpoint Assessment      : Disabled       perpetual

UC Phone Proxy Sessions           : 2              perpetual

Total UC Proxy Sessions           : 2              perpetual

Botnet Traffic Filter             : Disabled       perpetual

Intercompany Media Engine         : Disabled       perpetual

This platform has an ASA 5520 VPN Plus license.

Serial Number: 123456789AB

Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000

Configuration register is 0x0

Configuration last modified by enable_15 at 03:16:54.199 UTC Wed Sep 19 2018

ciscoasa(config)#

ciscoasa(config)# reload     // REBOOT THE ASA FOR SECURITY CONTEXT LICENSE TO TAKE EFFECT

System config has been modified. Save? [Y]es/[N]o: 

Cryptochecksum: 98cf2135 92873d13 a11da19a cf9d6707

1995 bytes copied in 1.650 secs (1995 bytes/sec)

Proceed with reload? [confirm]

ciscoasa(config)#

***

*** --- START GRACEFUL SHUTDOWN ---

Shutting down isakmp

Shutting down File system

***

*** --- SHUTDOWN NOW ---

REBOOT: open message queue fail: No such file or directory/2

REBOOT: enforce reboot...

Restarting system.

machine restart

ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 8.4(2)

Compiled on Wed 15-Jun-11 18:17 by builders

System image file is "Unknown, monitor mode tftp booted image"

Config file at boot was "startup-config"

ciscoasa up 59 secs

Hardware:   ASA 5520, 1024 MB RAM, CPU Pentium II 1000 MHz

Internal ATA Compact Flash, 256MB

BIOS Flash unknown @ 0x0, 0KB

 0: Ext: GigabitEthernet0    : address is 0000.ab5a.d200, irq 0

 1: Ext: GigabitEthernet1    : address is 0000.ab5a.d201, irq 0

 2: Ext: GigabitEthernet2    : address is 0000.ab5a.d202, irq 0

 3: Ext: GigabitEthernet3    : address is 0000.ab5a.d203, irq 0

Licensed features for this platform:

Maximum Physical Interfaces       : Unlimited      perpetual

Maximum VLANs                     : 100            perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Active/Active  perpetual

VPN-DES                           : Enabled        perpetual

VPN-3DES-AES                      : Enabled        perpetual

Security Contexts                 : 2              perpetual

GTP/GPRS                          : Disabled       perpetual

AnyConnect Premium Peers          : 5000           perpetual

AnyConnect Essentials             : Disabled       perpetual

Other VPN Peers                   : 5000           perpetual

Total VPN Peers                   : 0              perpetual

Shared License                    : Disabled       perpetual

AnyConnect for Mobile             : Disabled       perpetual

AnyConnect for Cisco VPN Phone    : Disabled       perpetual

Advanced Endpoint Assessment      : Disabled       perpetual

UC Phone Proxy Sessions           : 2              perpetual

Total UC Proxy Sessions           : 2              perpetual

Botnet Traffic Filter             : Disabled       perpetual

Intercompany Media Engine         : Disabled       perpetual

This platform has an ASA 5520 VPN Plus license.

Serial Number: 123456789AB

Running Permanent Activation Key: 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5

Configuration register is 0x0

Configuration has not been modified since last system restart.

ciscoasa#

ciscoasa# configure terminal

ciscoasa(config)#

***************************** NOTICE *****************************

Help to improve the ASA platform by enabling anonymous reporting,

which allows Cisco to securely receive minimal error and health

information from the device. To learn more about this feature,

please visit: http://www.cisco.com/go/smartcall

Would you like to enable anonymous error reporting to help improve

the product? [Y]es, [N]o, [A]sk later: 

ciscoasa(config)#

ciscoasa(config)# mode ?

configure mode commands/options:

  multiple   Multiple mode; mode with security contexts

  noconfirm  Do not prompt for confirmation

  single     Single mode; mode without security contexts

ciscoasa(config)# mode multiple

WARNING: This command will change the behavior of the device

WARNING: This command will initiate a Reboot

Proceed with change mode? [confirm]    

Convert the system configuration? [confirm]

!

The old running configuration file will be written to flash

Converting the configuration - this may take several minutes for a large configuration

The admin context configuration will be written to flash

The new running configuration file was written to flash

Security context mode: multiple

***

*** --- SHUTDOWN NOW ---

***

*** Message to all terminals:

***

***   change mode

REBOOT: open message queue fail: No such file or directory/2

REBOOT: enforce reboot...

Restarting system.

machine restart

ciscoasa# changeto system

ciscoasa# configure terminal

ciscoasa(config)#

***************************** NOTICE *****************************

Help to improve the ASA platform by enabling anonymous reporting,

which allows Cisco to securely receive minimal error and health

information from the device. To learn more about this feature,

please visit: http://www.cisco.com/go/smartcall

Would you like to enable anonymous error reporting to help improve

the product? [Y]es, [N]o, [A]sk later:

ciscoasa(config)#

ciscoasa(config)# hostname ? 

configure mode commands/options:

  WORD < 64 char  Host name for this system. A hostname must start and end with

                  a letter or digit and have as interior characters only

                  letters, digits, or a hyphen.

ciscoasa(config)# prompt ?

configure mode commands/options:

  context   Display the context in the session prompt (multimode only)

  domain    Display the domain in the session prompt

  hostname  Display the hostname in the session prompt

  priority  Display the priority in the session prompt

  state     Display the traffic passing state in the session prompt

ciscoasa(config)# prompt hostname context

ciscoasa(config)#

ciscoasa(config)# show run

: Saved

:

ASA Version 8.4(2) <system>

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

no mac-address auto

!

interface GigabitEthernet0

 shutdown

!

interface GigabitEthernet1

 shutdown

!

interface GigabitEthernet2

 shutdown

!

interface GigabitEthernet3

 shutdown

!

class default

  limit-resource All 0

  limit-resource ASDM 5

  limit-resource SSH 5

  limit-resource Telnet 5

!            

ftp mode passive

pager lines 24

no failover

no asdm history enable

arp timeout 14400

console timeout 0

admin-context admin

context admin

  config-url disk0:/admin.cfg

!

prompt hostname context

no call-home reporting anonymous

call-home

 profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

crashinfo save disable

Cryptochecksum:2812193d036302b9b304ad8b1772c974

: end

Ensure the ASA interfaces are unshut (no shutdown) in System Context.

ciscoasa(config)# interface g0

ciscoasa(config-if)# no shutdown

ciscoasa(config-if)# interface g1

ciscoasa(config-if)# no shutdown

ciscoasa(config-if)# int g1.444

ciscoasa(config-subif)# vlan 444

ciscoasa(config-subif)# no shut

ciscoasa(config-subif)#

ciscoasa(config-subif)# context TEST-1

Creating context 'TEST-1'... Done. (2)

ciscoasa(config-ctx)# allocate-interface g0

ciscoasa(config-ctx)# allocate-interface g1.444

ciscoasa(config-ctx)# config-url disk0:/TEST-1.cfg

WARNING: Could not fetch the URL disk0:/TEST-1.cfg

INFO: Creating context with default config

ciscoasa(config-ctx)# exit

ciscoasa(config)# end

ciscoasa# show run

: Saved

:

ASA Version 8.4(2) <system>

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

no mac-address auto

!

interface GigabitEthernet0

!

interface GigabitEthernet1

!

interface GigabitEthernet1.444

 vlan 444

!

interface GigabitEthernet2

 shutdown

!

interface GigabitEthernet3

 shutdown

!

class default

  limit-resource All 0

  limit-resource ASDM 5

  limit-resource SSH 5

  limit-resource Telnet 5

!

ftp mode passive

pager lines 24

no failover

no asdm history enable

arp timeout 14400

console timeout 0

admin-context admin

context admin

  config-url disk0:/admin.cfg

!

context TEST-1

  allocate-interface GigabitEthernet0

  allocate-interface GigabitEthernet1.444

  config-url disk0:/TEST-1.cfg

!

prompt hostname context

no call-home reporting anonymous

call-home

 profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

crashinfo save disable

Cryptochecksum:e0ee857ea073cb0043c19d47245179da

: end

 

ciscoasa# changeto context TEST-1

ciscoasa/TEST-1#

ciscoasa/TEST-1# show run

: Saved

:

ASA Version 8.4(2) <context>

!

hostname TEST-1

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface GigabitEthernet0

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet1.444

 no nameif

 no security-level

 no ip address

!

pager lines 24

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

telnet timeout 5

ssh timeout 5

no threat-detection statistics tcp-intercept

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

Cryptochecksum:2cb2107b9725b16aaf94ceb8f71ea75b

: end

In order to remove a Security Context, go under the System Context and simply issue a no context <CONTEXT NAME> and make sure to delete the context config in flash memory (disk0).

ciscoasa(config)# no context TEST-1

WARNING: Removing context 'TEST-1'

Proceed with removing the context? [confirm]

Removing context 'TEST-1' (2)... Done

ciscoasa(config)# delete config-url disk0:/TEST-1.cfg

ciscoasa(config)# show run

: Saved

:

ASA Version 8.4(2) <system>

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

no mac-address auto

!

interface GigabitEthernet0

!

interface GigabitEthernet1

!

interface GigabitEthernet1.444

 vlan 444

!

interface GigabitEthernet2

 shutdown

!

interface GigabitEthernet3

 shutdown

!

class default

  limit-resource All 0

  limit-resource ASDM 5

  limit-resource SSH 5

  limit-resource Telnet 5

!

ftp mode passive

pager lines 24

no failover

no asdm history enable

arp timeout 14400

console timeout 0

admin-context admin

context admin

  config-url disk0:/admin.cfg

!

prompt hostname context

no call-home reporting anonymous

call-home

 profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

crashinfo save disable

Cryptochecksum:f3ea19991e889c8988eef5380a4c345c

: end