Check FWSM Resources

show resource allocation detail
show resource allo
sh resource usage
sh resource usage all
show np pc
show np block
show np all status

Vlan configuration mismatch on FWSM and pseudo-Standby state

There are some conditions that can lead fwsm failover pair to go to the pseudo-Standby state. This is caused because there is a vlan mismatch between the 2 fwsm in failover mode.

In the pseudo-standby blade, you will find when you try to activate the standby unit with the command:
failover

you get:

Detected an Active mate
Vlan configuration mismatch
Failover will be disabled

After checking the configuration on context system, verifying the firewall vlan-group on both supervisors, all the configurations are exactly the same.

The problem can only be seen if you type "show vlan" in the system context. This command will show you exactly which interfaces are used by the fwsm. You will find any inconsistence by comparing the output of "show vlan" in both system contexts.

To fix the problem, remove the vlan from the supervisor and add it again.
For example, if the inconsistence is with the vlan 10, do the following on both modules:

no firewall vlan-group 1 10
firewall vlan-group 1 10

After this compare again the "show vlan" command and verify that the inconsistence is gone.
Now , type the following command in the pseudo-standby one:
failover

You will see it syncing config.
The status will change in this sequence in the "show failover" (this happened in the primary unit):

This host: Primary - Cold Standby
..
This host: Primary - Sync Config
..
End configuration replication from mate.
..
This host: Primary - Bulk Sync
..
This host: Primary - Standby Ready

Good luck! :)

ASA Virtualization context configuration

ASA licensing will allow you or not to use virtual contexts.
In order to use them, will will have first to change the mode of the firewall:

firewall(config)# mode multiple
WARNING: This command will change the behavior of the device
WARNING: This command will initiate a Reboot
Proceed with change mode? [confirm] yes
After the reboot, just create your admin-context
firewall(config)#
firewall(config)# admin-context admin
Creating context 'admin'... Done. (13)

Alocating interfaces:
firewall(config)# context admin
firewall(config-ctx)# allocate-interface GigabitEthernet0/0.101
firewall(config-ctx)# allocate-interface GigabitEthernet0/1.102
firewall(config-ctx)# allocate-interface Management0/0
firewall(config-ctx)# config-url disk0:/admin.cfg

in FWSM you can add Vlans L3 as interfaces:
fwsm(config)# context Internet
fwsm(config-ctx)# allocate-interface Vlan1000
fwsm(config-ctx)# allocate-interface Vlan1001
fwsm(config-ctx)# config-url disk0:/internet.cfg

FWSM/ASA/PIX must have generated certicate for ssh session to be established

In order to iniciate an SSH session to the firewall , you must enter the following command:

Prior to version FWSM 2.X or PIX 6.X:
ca generate rsa key 1024

After those version use:
crypto key generate rsa modulus 1024

Howto FWSM Hardware reset

Sometimes ... and unfortunatly ... the FWSM is not that stable. It has happened that, in a FWSM failover pair, when one fails, the other doesn't take over and simply hangs. In order to reset the blade run this command in the supervisor:

hw-mod module 9 reset (for module 9)
hw-mod module 9 shutdown (power off to the module. Keep in mind that if the 6500/7600 is reloaded, the FWSM blade will power on anyway, even if previously this command has been called)