Table Of Contents
System Log Messages
This chapter lists the system log messages in numerical order.
Note
When a number is skipped in a sequence, the message is no longer in the security appliance code.
This chapter includes the following sections:
Messages 101001 to 199010
This section contains messages from 101001 to 199010.
101001
Error Message %PIX|ASA-1-101001: (Primary) Failover cable OK.Explanation This is a failover message. This message reports that the failover cable is present and functioning correctly. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
101002
Error Message %PIX|ASA-1-101002: (Primary) Bad failover cable.Explanation This is a failover message. This message reports that the failover cable is present but not functioning correctly. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Replace the failover cable.
101003, 101004
Error Message %PIX|ASA-1-101003: (Primary) Failover cable not connected (this unit).Error Message %PIX|ASA-1-101004: (Primary) Failover cable not connected (other unit).Explanation Both instances are failover messages. These messages are logged when failover mode is enabled, but the failover cable is not connected to one unit of the failover pair. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Connect the failover cable to both units of the failover pair.
101005
Error Message %PIX|ASA-1-101005: (Primary) Error reading failover cable status.Explanation This is a failover message. This message is displayed if the failover cable is connected, but the primary unit is unable to determine its status.
Recommended Action Replace the cable.
102001
Error Message %PIX|ASA-1-102001: (Primary) Power failure/System reload other side.Explanation This is a failover message. This message is logged if the primary unit detects a system reload or a power failure on the other unit. "Primary" can also be listed as "Secondary" for the secondary unit.
Recommended Action On the unit that experienced the reload, issue the show crashinfo command to determine if there is a traceback associated with the reload. Also verify that the unit is powered on and that power cables are properly connected.
103001
Error Message %PIX|ASA-1-103001: (Primary) No response from other firewall (reason code = code).Explanation This is a failover message. This message is displayed if the primary unit is unable to communicate with the secondary unit over the failover cable. (Primary) can also be listed as (Secondary). for the secondary unit. Table 2-1 lists the reason codes and the descriptions to determine why the failover occurred.
Recommended Action Verify that the failover cable is connected properly and both units have the same hardware, software, and configuration; otherwise, contact the Cisco TAC.
103002
Error Message %PIX|ASA-1-103002: (Primary) Other firewall network interface interface_number OK.Explanation This is a failover message. This message is displayed when the primary unit detects that the network interface on the secondary unit is okay. (Primary) can also be listed as (Secondary) for the secondary unit. See Table 1-4 in Chapter 1, "Configuring Logging and SNMP," for possible values for the interface_number variable.
Recommended Action None.
103003
Error Message %PIX|ASA-1-103003: (Primary) Other firewall network interface interface_number failed.Explanation This is a failover message. This message is displayed if the primary unit detects a bad network interface on the secondary unit. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Check the network connections on the secondary unit and check the network hub connection. If necessary, replace the failed network interface.
103004
Error Message %PIX|ASA-1-103004: (Primary) Other firewall reports this firewall failed.Explanation This is a failover message. This message is displayed if the primary unit receives a message from the secondary unit indicating that the primary has failed. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Verify the status of the primary unit.
103005
Error Message %PIX|ASA-1-103005: (Primary) Other firewall reporting failure.Explanation This is a failover message. This message is displayed if the secondary unit reports a failure to the primary unit. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Verify the status of the secondary unit.
104001, 104002
Error Message %PIX|ASA-1-104001: (Primary) Switching to ACTIVE (cause: string).Error Message %PIX|ASA-1-104002: (Primary) Switching to STNDBY (cause: string).Explanation Both instances are failover messages. These messages usually are logged when you force the pair to switch roles, either by entering the failover active command on the standby unit, or the no failover active command on the active unit. (Primary) can also be listed as (Secondary) for the secondary unit. Possible values for the string variable are as follows:
•
•
•
•
•
•
•
Recommended Action If the message occurs because of manual intervention, no action is required. Otherwise, use the cause reported by the secondary unit to verify the status of both units of the pair.
104003
Error Message %PIX|ASA-1-104003: (Primary) Switching to FAILED.Explanation This is a failover message. This message is displayed when the primary unit fails.
Recommended Action Check the system log messages for the primary unit for an indication of the nature of the problem (see message 104001). (Primary) can also be listed as (Secondary) for the secondary unit.
104004
Error Message %PIX|ASA-1-104004: (Primary) Switching to OK.Explanation This is a failover message. This message is displayed when a previously failed unit now reports that it is operating again. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
105001
Error Message %PIX|ASA-1-105001: (Primary) Disabling failover.Explanation This is a failover message. This message is displayed when you enter the no failover command on the console. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
105002
Error Message %PIX|ASA-1-105002: (Primary) Enabling failover.Explanation This is a failover message. This message is displayed when you enter the failover command with no arguments on the console, after having previously disabled failover. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
105003
Error Message %PIX|ASA-1-105003: (Primary) Monitoring on interface interface_name waitingExplanation This is a failover message. The security appliance is testing the specified network interface with the other unit of the failover pair. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None. The security appliance monitors its network interfaces frequently during normal operations.
105004
Error Message %PIX|ASA-1-105004: (Primary) Monitoring on interface interface_name normalExplanation This is a failover message. The test of the specified network interface was successful. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
105005
Error Message %PIX|ASA-1-105005: (Primary) Lost Failover communications with mate on interface interface_name.Explanation This is a failover message. This message is displayed if this unit of the failover pair can no longer communicate with the other unit of the pair. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Verify that the network connected to the specified interface is functioning correctly.
105006, 105007
Error Message %PIX|ASA-1-105006: (Primary) Link status `Up' on interface interface_name.Error Message %PIX|ASA-1-105007: (Primary) Link status `Down' on interface interface_name.Explanation Both instances are failover messages. These messages report the results of monitoring the link status of the specified interface. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action If the link status is down, verify that the network connected to the specified interface is operating correctly.
105008
Error Message %PIX|ASA-1-105008: (Primary) Testing interface interface_name.Explanation This is a failover message. This message is displayed when the tests a specified network interface. This testing is performed only if the security appliance fails to receive a message from the standby unit on that interface after the expected interval. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None.
105009
Error Message %PIX|ASA-1-105009: (Primary) Testing on interface interface_name {Passed|Failed}.Explanation This is a failover message. This message reports the result (either Passed or Failed) of a previous interface test. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action None required if the result is Passed. If the result is Failed, you should check the network cable connection to both failover units, that the network itself is functioning correctly, and verify the status of the standby unit.
105010
Error Message %PIX|ASA-3-105010: (Primary) Failover message block alloc failedExplanation Block memory was depleted. This is a transient message and the security appliance should recover. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Use the show blocks command to monitor the current block memory.
105011
Error Message %PIX|ASA-1-105011: (Primary) Failover cable communication failureExplanation The failover cable is not permitting communication between the primary and secondary units. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Ensure that the cable is properly connected.
105020
Error Message %PIX|ASA-1-105020: (Primary) Incomplete/slow config replicationExplanation When a failover occurs, the active security appliance detects a partial configuration in memory. Normally, this is caused by an interruption in the replication service. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Once the failover is detected by the security appliance, the security appliance automatically reloads itself and loads configuration from Flash memory and/or resynchronizes with another security appliance. If failovers happen continuously, check the failover configuration and make sure both security appliance units can communicate with each other.
105021
Error Message %PIX|ASA-1-105021: (failover_unit) Standby unit failed to sync due to a locked context_name config. Lock held by lock_owner_nameExplanation During configuration synchronizing, a standby unit will reload itself if some other process locks the configuration for more than 5 minutes, which prevents the failover process from applying the new configuration. This can occur when an administrator pages through a running configuration on the standby unit while configuration synchronization is in process. See also the show running-config EXEC command and the pager lines num CONFIG command.
Recommended Action Avoid viewing or modifying configuration on standby unit when it first comes up and is in the process of establishing a failover connection with the active unit.
105031
Error Message %PIX|ASA-1-105031: Failover LAN interface is upExplanation LAN failover interface link is up.
Recommended Action None.
105032
Error Message %PIX|ASA-1-105032: LAN Failover interface is downExplanation LAN failover interface link is down.
Recommended Action Check the connectivity of the LAN failover interface. Make sure that the speed/duplex setting is correct.
105034
Error Message %PIX|ASA-1-105034: Receive a LAN_FAILOVER_UP message from peer.Explanation The peer has just booted and sent the initial contact message.
Recommended Action None.
105035
Error Message %PIX|ASA-1-105035: Receive a LAN failover interface down msg from peer.Explanation The peer LAN failover interface link is down. The unit switches to active mode if it is in standby mode.
Recommended Action Check the connectivity of the peer LAN failover interface.
105036
Error Message %PIX|ASA-1-105036: dropped a LAN Failover command message.Explanation The security appliance dropped an unacknowledged LAN failover command message, indicating a connectivity problem on the LAN failover interface.
Recommended Action Check that the LAN interface cable is connected.
105037
Error Message %PIX|ASA-1-105037: The primary and standby units are switching back and forth as the active unit.Explanation The primary and standby units are switching back and forth as the active unit, indicating a LAN failover connectivity problem or software bug.
Recommended Action Check that the LAN interface cable is connected.
105038
Error Message %PIX|ASA-1-105038: (Primary) Interface count mismatchExplanation When a failover occurs, the active security appliance detects a partial configuration in memory. Normally, this is caused by an interruption in the replication service. (Primary) can also be listed as (Secondary) for the secondary unit.
Recommended Action Once the failover is detected by the security appliance, the security appliance automatically reloads itself and loads the configuration from Flash memory and/or resyncs with another security appliance. If failovers happen continuously, check the failover configuration and make sure that both security appliance units can communicate with each other.
105039
Error Message %PIX|ASA-1-105039: (Primary) Unable to verify the Interface count with mate. Failover may be disabled in mate.Explanation Failover initially verifies that the number of interfaces configured on the primary and secondary security appliances are the same. This message indicates that the primary security appliance is not able to verify the number of interfaces configured on the secondary security appliance. This message indicates that the primary security appliance is not able communicate with the secondary security appliance over the failover interface. (Primary) can also be listed as (Secondary) for the secondary security appliance.
Recommended Action Verify the failover LAN, interface configuration, and status on the primary and secondary security appliances. Make sure that the secondary security appliance is running the security appliance application and that failover is enabled.
105040
Error Message %PIX|ASA-1-105040: (Primary) Mate failover version is not compatible.Explanation The primary and secondary security appliance should run the same failover software version to act as a failover pair. This message indicates that the secondary security appliance failover software version is not compatible with the primary security appliance. Failover is disabled on the primary security appliance. (Primary) can also be listed as (Secondary) for the secondary security appliance.
Recommended Action Maintain consistent software versions between the primary and secondary security appliances to enable failover.
105042
Error Message %PIX|ASA-1-105042: (Primary) Failover interface OKExplanation LAN failover interface link is up.
Explanation The interface used to send failover messages to the secondary security appliance is functioning. (Primary) can also be listed as (Secondary) for the secondary security appliance.
Recommended Action None.
105043
Error Message %PIX|ASA-1-105043: (Primary) Failover interface failedExplanation LAN failover interface link is down.
Recommended Action Check the connectivity of the LAN failover interface. Make sure that the speed/duplex setting is correct.
105044
Error Message %PIX|ASA-1-105044: (Primary) Mate operational mode mode is not compatible with my mode mode.Explanation When the operational mode (single or multi) does not match between failover peers, failover will be disabled.
Recommended Action Configure the failover peers to have the same operational mode, and then reenable failover.
105045
Error Message %PIX|ASA-1-105045: (Primary) Mate license (number contexts) is not compatible with my license (number contexts).Explanation When the feature licenses do not match between failover peers, failover will be disabled.
Recommended Action Configure the failover peers to have the same feature license, and then reenable failover.
105046
Error Message %PIX|ASA-1-105046 (Primary|Secondary) Mate has a different chassisExplanation This message is issued when two failover units have a different type of chassis. For example, one is a PIX, the other is an ASA-5520, or one has a 3-slot chassis, the other has a 6-slot chassis.
Recommended Action Make sure that the two failover units are the same.
105047
Error Message %PIX|ASA-1-105047: Mate has a io_card_name1 card in slot slot_number which is different from my io_card_name2Explanation The two failover units have different types of cards in their respective slots.
Recommended Action Make sure that the card configurations for the failover units are the same.
105048
Error Message %ASA-1-105048: (unit) Mate's service module (application) is different from mine (application)Explanation The failover process detected that different applications are running on the service modules in the active and standby units. The two failover units are incompatible if different service modules are used.
unit—Primary or secondary.
application—The name of the application, such as InterScan Security Card.
Recommended Action Make sure that both units have identical service modules before trying to re-enable failover.
106001
Error Message %PIX|ASA-2-106001: Inbound TCP connection denied from IP_address/port to IP_address/port flags tcp_flags on interface interface_nameExplanation This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by the security policy that is defined for the specified traffic type. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the security appliance, and it was dropped. The tcp_flags in this packet are FIN and ACK.
The tcp_flags are as follows:
•
•
•
•
•
•
Recommended Action None.
106002
Error Message %PIX|ASA-2-106002: protocol Connection denied by outbound list acl_ID src
