2. 程式人生 > >Cisco ASA firewall Active/Standby failover

Cisco ASA firewall Active/Standby failover

阿新 • • 發佈：2018-06-03
cisco asa failover

In this article, I will briefly explain the active/standby failover configuration on the cisco ASA. The lab is done in GNS3.

  1. Physical Topology:
    技術分享圖片

  2. configuration:
    ciscoasa/act/pri(config)# sh run failover
    failover
    failover lan unit primary
    failover lan interface Failover_Stateless GigabitEthernet0/2
    failover link Failover_Stateful GigabitEthernet0/1

    failover interface ip Failover_Stateless 169.254.0.15 255.255.255.0 standby 169.254.0.16
    failover interface ip Failover_Stateful 169.254.1.15 255.255.255.0 standby 169.254.1.16

  3. pitfall:
    The failover ASA pair should have identical hardware platform, software and license to achieve working failover.
    The failover configuration order is important. It could blank your active configuration if the order is not correct.
    Also, whenever there is an configuration update, it should be done on the primary / active unit, so the change could be synched to the standby.
    Do this:
    config # prompt hostname state priority
  4. the failover could be stateless and stateful, the above configuration configured G0/1 as stateful failover interface.

  5. The "show failover" command will provide the current failover state. If you need to have any interface monitored, do below and add a standby ip address for the interface:
    config # monitor-interface inside | outside | etc.

    ciscoasa/act/pri(config)# sh monitor-interface
    This host: Primary - Active
    Interface management (172.16.212.96): Normal (Waiting)
    Interface inside (10.1.1.1): Normal (Monitored)
    Interface outside (150.1.115.1): Normal (Monitored)
    Other host: Secondary - Standby Ready
    Interface management (0.0.0.0): Normal (Waiting)
    Interface inside (10.1.1.2): Normal (Monitored)
    Interface outside (150.1.115.2): Normal (Monitored)

  6. when doing the test, you could enter "failover active" on the secondary ASA, and there will be no interruption for the telnet tcp connection that already exists. As the connection is on both ASA.

ciscoasa/stby/sec# sh conn
9 in use, 9 most used

TCP outside 150.1.115.100:23 inside 10.1.1.100:32526, idle 0:00:18, bytes 147, flags UIO
ciscoasa/stby/sec#

ciscoasa/stby/sec# sh conn
9 in use, 9 most used

TCP outside 150.1.115.100:23 inside 10.1.1.100:32526, idle 0:00:18, bytes 147, flags UIO
ciscoasa/stby/sec#

ciscoasa/act/pri# sh failover interface
interface Failover_Stateless GigabitEthernet0/2
System IP Address: 169.254.0.15 255.255.255.0
My IP Address : 169.254.0.15
Other IP Address : 169.254.0.16
interface Failover_Stateful GigabitEthernet0/1
System IP Address: 169.254.1.15 255.255.255.0
My IP Address : 169.254.1.15
Other IP Address : 169.254.1.16

ciscoasa/act/pri# sh failover

Failover On
Failover unit Primary
Failover LAN Interface: Failover_Stateless GigabitEthernet0/2 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 36 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.6(2), Mate 9.6(2)
Serial Number: Ours 9A9PLK9VKN2, Mate 9A8UNB99VES
Last Failover at: 11:59:50 UTC Jun 2 2018
This host: Primary - Active
Active time: 1082 (sec)
slot 0: empty
Interface management (172.16.212.96): Normal (Waiting)
Interface inside (10.1.1.1): Normal (Monitored)
Interface outside (150.1.115.1): Normal (Monitored)
Other host: Secondary - Standby Ready
Active time: 137 (sec)
Interface management (0.0.0.0): Normal (Waiting)
Interface inside (10.1.1.2): Normal (Monitored)
Interface outside (150.1.115.2): Normal (Monitored)

  1. Interesting Log:

This is from primary:
ciscoasa(config)# failover
ciscoasa(config)# %ASA-1-105002: (Primary) Enabling failover.
.

    No Active mate detected

Beginning configuration replication: Sending to mate.
%ASA-1-709003: (Primary) Beginning configuration replication: Send to mate.
End Configuration Replication to mate
%ASA-1-709004: (Primary) End Configuration Replication (ACT)

This is from Secondary:
Detected an Active mate
Beginning configuration replication from mate.
%ASA-1-709005: (Secondary) Beginning configuration replication: Receiving from mate.
WARNING: Disabling auto import may affect Smart Licensing
Creating trustpoint "_SmartCallHome_ServerCA" and installing certificate...

Trustpoint CA certificate accepted.
WARNING: Failover is enabled but standby IP address is not configured for this interface.
WARNING: Failover is enabled but standby IP address is not configured for this interface.

WARNING: Failover is enabled but standby IP address is not configured for this interface.
WARNING: Trustpoint _SmartCallHome_ServerCA is already authenticated.
End configuration replication from mate.

ciscoasa(config)# %ASA-4-405003: IP address collision detected between host 169.254.0.15 at 5260.89c0.6003 and interface Failover_Stateless, 5260.89e7.4903

ciscoasa/act/pri# sh arp
inside 10.1.1.100 aabb.cc00.0200 2408
outside 150.1.115.100 aabb.cc00.0300 1761
Failover_Stateless 169.254.0.16 5260.89c0.6003 1248
Failover_Stateful 169.254.1.16 5260.89c0.6002 2030

ciscoasa/stby/sec# sh arp
inside 10.1.1.100 aabb.cc00.0200 2069
Failover_Stateless 169.254.0.15 5260.89e7.4903 1289
outside 150.1.115.100 aabb.cc00.0300 1802
Failover_Stateful 169.254.1.15 5260.89e7.4902 207

Cisco ASA firewall Active/Standby failover

相關推薦

Cisco ASA firewall Active/Standby failover

cisco asa failoverIn this article, I will briefly explain the active/standby failover configuration on the cisco ASA. The lab is done in GNS3. Physical T

Cisco ASA firewall swap

secondary tro swap 思科 更換 effect ilove oss ping Cisco ASA FW replacement Active sand Standby Mode 思科防火墻 更換 must make sure the cross conne

思科ASA部署Failover （Active/Standby）

思科asa部署failover （active/standby） 思科ASA部署Failover（Active/Standby） Failover Failover是思科防火墻一種高可用技術，能在防火墻發生故障時數秒內轉移配置到另一臺設備，使網絡保持暢通，達到設備級

cisco ASA 551X系列防火墻限速

cisco asa 限速asa 551X 網絡限速對整個網段限速 也可對單個ip 實例中為對網段限速4Masa846-k8.bin 測試okobject-group network rate_limitnetwork-object 192.168.0.0 255.255.255.0access-list ra

Cisco—ASA的基本思路和應用

ASA PNAT ACL 基本 ASA-防火墻-cisco ASA防火墻的作用1、在網絡中隔離危險流量，不分地點。ASA防火墻的原理1、通過安全級別區分不同的區域：內部區域、外部區域、非軍事化區域。默認情況下： 高級別的流量可以去低級別的，低級別的流量不

cisco ASA ios升級或恢復

地址 tel ble software file pin 本機 AD 新版本 cisco ASA ios升級或恢復 一、升級前準備工作 1、準備好所要升級的IOS文件及對應的ASDM文件 2、在一臺電腦上架設好tftp，設置好目錄，與防火墻進行連接（假設電腦IP為192.1

Cisco ASA(8.4)端口映射設定(ASDM)

服務 技術分享 conf ice .com rdquo sdm ima fire 1.進入到Configuration→firewall→NAT Rules畫面。 2.點“services”添加服務端口，此案例添加TCP 14

8-思科防火墻：Cisco ASA uRPF運用

path 屬於 -o log 防火墻 51cto shadow ima ext 一、實驗拓撲：二、實驗要求：1、面試：怎樣有效的去防止地址欺騙技術？配URPF三、命令部署：ASA(config)# ip verify reverse-path interface outsi

在Cisco ASA和FTD中發現重大影響DoS漏洞

思科剛剛在其自適應安全裝置（ASA）和Firepower威脅防禦（FTD）軟體的會話啟動協議（SIP）檢查引擎中披露了一個主動利用的拒絕服務（DoS）漏洞。 安全問題可能允許潛在的遠端和未經身份驗證的攻擊者“導致受影響的裝置重新載入或觸發高CPU，從而導致拒絕服務（DoS）狀況。” 正如思科在其諮詢中所詳

cisco asa(asa5510 設定)防火牆的配置詳解

今天在一個客戶那邊配置的 asa5510(config)#             asa5510(config)# show run : Saved : ASA Version 7.0(7)  ! hostname asa5510 主機名domain-name 1

Cisco ASA防火牆SSL VPN的配置

SSL VPN裝置有很多。如Cisco 路由器、Cisco PIX防火牆、Cisco ASA 防火牆、Cisco VPN3002 硬體客戶端或軟體客戶端。這極大地簡化了遠端端管理和配置。說的簡單點就是在Server 端配置複雜的策略和金鑰管理等命令，而在我們的客戶端上只

Cisco ASA 應用NAT配置詳解

out con 端口 access nat配置 都是 多對一 允許 10.10 ASA 防火墻上NAT的基本原理與路由器上一樣，只不過只用定義一下內網地址和進行轉換後的地址就可以了，不需要進入接口再應用了。基本上兩條命令即可完成一種NAT的配置。ASA上的NAT有動態NA

Cisco ASA 高級配置之URL過濾

inter vpd fff sid 數據包 -m 擴展名 技術分享 nec 現在呢，有很多管理上網行為的軟件，那麽ASA作為狀態化防火墻，它也可以進行管理上網行為，我們可以利用ASA防火墻iOS的特性實施URL過濾可以對訪問的網站域名進行控制，從而達到某種管理目的。實施UR

淺談Cisco ASA應用NAT

基於 類型 定義 con bubuko 復雜 control 1.10 動態nat NAT的類型ASA上的NAT配置相對路由器來說要復雜一些，ASA上的NAT有動態NAT，動態PAT，靜態NAT和靜態PAT四種類型 動態NAT：多對多的轉換，將多個私網映射到多個公網 動態

淺談Cisco ASA的基礎

conf 遠程管理 執行 化工 ati cisco 網絡防火墻 authent 技術分享 軟件防火墻和硬件防火墻1）軟件防火墻系統防火墻，TMG防火墻，IP tables防火墻，處理數據速度慢，穩定性差2）硬件防火墻ASA，深信服，華為都屬於硬件防火墻，穩定性強，處理數據速

PostgreSQL-113-try-the-hot-standby-failover

1 Overview We'll build two PostgreSQL database nodes, node1 and n

查看name的狀態，是屬於active還是standby

hdfs stat standby 屬於 默認 sta gets hdf cti sudo -E -u hadoop /home/hadoop/bin/hdfs haadmin -getServiceState nn1 sudo -E -u hadoop /home/had

postgresql 高可用 repmgr 的使用之五 1 Primary + 1 Standby 的 manual failover,node rejoin

os：ubunbu 16.04 postgresql：9.6.8 repmgr：4.1.1 192.168.56.101 node1 192.168.56.102 node2 操作前/etc/repmgr.conf 的內容 node1 節點上的檔案內容，node

ASA Failover

1、ASA Failover狀態： 配置Failover需要兩個相同的ASA裝置，兩個ASA裝置通過專門的故障轉移鏈路相互連線。 ASA Failover有兩種狀態：Active/Active failover  &  Active/Standby failover. A/

Hadoop2.7.0叢集的NameNode在HA下如何切換active和standby狀態

       1、筆者所在公司的開發環境搭建了一個hadoop叢集，為保證HDFS的高可用，配置了NameNode的HA模式 ， 10.17.2.134 為active ，10.17.2.121為standby         2、筆者平時訓練寫的很多mapreduce