ASA多模式下配置Activestandby Failover

ASA多模式(Multiplemode)下配置Active/standbyFailover文章摘要：l如下图配置ASA:ContextInterfaceIPAddressNameifcle00outsideel0insideContextInterfaceIPAddressNameifc2e00outsidee0insidel使用E3口作为拷贝配置文件和状态信息l如下图配置ASA：ContextInterfaceIPAddressNameifc1e0outsidee0insideContextInterfaceIPAddressNameifc2e00outsidee0insidel使用E3口作为拷贝配置文件和状态信息的接口；lFailoverIP地址为;lFailoverkey为ciscoask；l要求ASA1正常下为Active；配置交换机配置ASA1asa1(config)#admin-contextadminCreatingcontext'admin'...Done.(1)asa1(config)#contextadminasa1(config-ctx)#config-urladmin.cfgINFO:Convertingadmin.cfgtoflash:/admin.cfgINFO:ContextadminwascreatedwithURLflash:/admin.cfgINFO:Admincontextwilltakesometimetocomeup....pleasewait.Creatingcontext'cl'...Done.(2)asal(config-ctx)#allocate-interfacee0asal(config-ctx)#allocate-interfacee1asa1(config-ctx)#config-urlc1.cfgINFO:Convertingc1.cfgtoflash:/c1.cfgWARNING:CouldnotfetchtheURLflash:/c1.cfgINFO:Creatingcontextwithdefaultconfigasa1(config-ctx)#contextc2Creatingcontext'c2'...Done.(3)asa1(config-ctx)#allocate-interfacee0asa1(config-ctx)#allocate-interfacee2asa1(config-ctx)#config-urlc2.cfgINFO:Convertingc2.cfgtoflash:/c2.cfgWARNING:CouldnotfetchtheURLflash:/c2.cfgINFO:Creatingcontextwithdefaultconfigasa1(config-ctx)#//注意：接口要在system下noshutasa1(config)#changetocontextc1asa1/c1(config)#intere0asa1/c1(config-if)#ipadd0INFO:Securitylevelfor"outside"setto0bydefault.asa1/c1(config-if)#intere1asa1/c1(config-if)#ipadd0asa1/c1(config-if)#nameifinsideINFO:Securitylevelfor"inside"setto100bydefault.asa1/c1(config-if)#asa1/c1(config-if)#changetocontextc2asa1/c2(config)#intere0asa1/c2(config-if)#ipadd0asa1/c2(config-if)#nameifoutsideINFO:Securitylevelfor"outside"setto0bydefault.asa1/c2(config-if)#intere2asa1/c2(config-if)#ipadd0asa1/c2(config-if)#nameifinsideINFO:Securitylevelfor"inside"setto100bydefault.asa1/c2(config-if)#//然后测试连通性(注意放流量)，发现R1和R2都不能够ping通R3,因为E0是共享接口，因此要对流量进行分类，我们这里使用基于MAC地址对流量进行分类：asa1/c1(config)#intere0asa1/c1(config-if)#mac-addressc1.c1.c1asa1/c1(config-if)#changetocontextc2asa1/c2(config)#intere0asa1/c2(config-if)#mac-addressc2.c2.c2//然后配置Failover,注意，不管什么模式，Failover都在system下配置asa1/c1(config)#intere0asa1/c1(config-if)#ipadd0standby50asa1/c1(config-if)#intere1asa1/c1(config-if)#ipadd0standby50asa1/c2(config)#intere0asa1/c2(config-if)#ipadd0standby50asa1/c2(config-if)#intere2asa1/c2(config-if)#ipadd0standby50asa1/c2(config-if)#changetosyasa1(config)#intere3asa1(config-if)#noshutasa1(config)#failoverlanenableasa1(config)#failoverlanunitprimaryasa1(config)#failoverlaninterfacefailovere3INFO:Non-failoverinterfaceconfigisclearedonEthernet3anditssub-interfacesasa1(config)#failoverlinkfailovere3 〃启用带状态的Failoverasa1(config)#failinteripfailoverstandby192.1681.2asal(config)#failover配置ASA2pixfirewall(config)#showmode //要保证ASA2(standby)也是多模式；Securitycontextmode:multiplepixfirewall(config)#intere3pixfirewall(config-if)#noshutpixfirewall(config)#failoverlanenablepixfirewall(config)#failoverlanunitsecpixfirewall(config)#failoverlaninterfailovere3INFO:Non-failoverinterfaceconfigisclearedonEthernet3anditssub-interfacespixfirewall(config)#failinteripfailoverstanpixfirewall(config)#failoverkeyciscoaskpixfirewall(config)#failoverpixfirewall(config)#.DetectedanActivemateBeginningconfigurationreplicationfrommate.WARNING:Unabletodeleteadmincontext,becauseitdoesn'texist.INFO:AdmincontextisrequiredtogettheinterfacesCreatingcontext'admin'...Done.(1)WARNING:SkipfetchingtheURLflash:/admin.cfgINFO:CreatingcontextwithdefaultconfigINFO:Admincontextwilltakesometimetocomeup....pleasewait.Creatingcontext'c1'...Done.(2)WARNING:SkipfetchingtheURLflash:/c1.cfgINFO:CreatingcontextwithdefaultconfigCreatingcontext'c2'...Done.(3)WARNING:SkipfetchingtheURLflash:/c2.cfgINFO:CreatingcontextwithdefaultconfigEndconfigurationreplicationfrommate.asa1(config)#然后在ASA1上showfailoverasa1(config)#showfailoverFailoverOnCablestatus:N/A-LAN-basedfailoverenabledFailoverunitPrimaryFailoverLANInterface:failoverEthernet3(up)UnitPollfrequency15seconds,holdtime45secondsInterfacePollfrequency5seconds,holdtime25secondsInterfacePolicy1MonitoredInterfaces4of250maximumVersion:Ours7.2(2),Mate7.2(2)LastFailoverat:21:12:51UTCDec32007Thishost:Primary-ActiveActivetime:465(sec)c1Interfaceoutside(0):NormalclInterfaceinside(0):Normalc2Interfaceoutside(0):Normalc2Interfaceinside(0):NormalOtherhost:Secondary-StandbyReadyActivetime:0(sec)c1Interfaceoutside(50):Normalc1Interfaceinside(50):Normalc2Interfaceoutside(50):Normalc2Interfaceinside(50):NormalStatefulFailoverLogicalUpdateStatistics //状态信息Link:failoverEthernet3(up)StatefulObjxmitxerrrcvrerrGeneral390350syscmd350350uptime0000RPCservices0000TCPconn0000UDPconn0000ARPtbl4000Xlate_Timeout0000LogicalUpdateQueueInformation

CurMaxT