In this article will demonstrate on how to configure Active Standby failover on cisco ASA 5520 ASA firewall and how to verify and troubleshoot configuration step by step. This article is useful if you understand the theoretical part of the failover.
ASA1 Primary Configuration
ciscoasa(config)# int e2
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to
100 by default.
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ip address 192.168.0.254
255.255.255.0 standby 192.168.0.253
ciscoasa(config-if)# int e3
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by
default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ip address 192.168.2.254
255.255.255.0 standby 192.168.2.253
ciscoasa(config-if)# no shu
ciscoasa(config-if)# in e4
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to
0 by default.
ciscoasa(config-if)# no shu
ciscoasa(config-if)# ip address 192.168.1.254
255.255.255.0 standby 192.168.1.253
ciscoasa(config)# int e0 ! failover lan interface for
configuration replication
ciscoasa(config-if)# no sh
ciscoasa(config-if)# int e1 ! stateful link interface for stateful
information replication
ciscoasa(config-if)# no sh
ciscoasa(config)# failover lan interface fail-1
e0
ciscoasa(config)# failover interface ip fail-1
10.10.10.1 255.255.255.252 standby 10.10.10.2
ciscoasa(config)# failover link fail-1 e0
Note that it’s recommended to use another interface
for stateful replication, but here we use the same interface for config
replication and stateful replication.
ciscoasa(config)# failover interface ip fail-1
10.10.10.1 255.255.255.252 standby 10.10.10.2
ciscoasa(config)# failover replication http
ciscoasa(config)# failover lan unit primary
ciscoasa(config)# failover key cisco
ciscoasa(config)# prompt hostname priority state
ciscoasa/pri/actNoFailover(config)# failover
ciscoasa/pri/act(config)# show failover
Failover On
Failover unit Primary
Failover LAN Interface: fail-1 Ethernet0 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25
seconds
Interface Policy 1
Monitored Interfaces 3 of 60 maximum
failover replication http
Version: Ours 9.1(5)16, Mate Unknown
Last Failover at: 14:44:50 UTC Sep 21 2019
This host: Primary - Negotiation
Active time: 0 (sec)
Interface inside (192.168.0.254): No Link (Waiting)
Interface dmz (192.168.2.254): No Link (Waiting)
Interface outside (192.168.1.254): No Link (Waiting)
Other host: Secondary - Not Detected
Active time: 0 (sec)
Interface inside (192.168.0.253):
Unknown (Waiting)
Interface dmz (192.168.2.253): Unknown (Waiting)
Interface outside (192.168.1.253): Unknown (Waiting)
Stateful Failover Logical Update Statistics
……….
No Active mate detected
ciscoasa/pri/act(config)# sh failover state
State Last Failure
Reason Date/Time
This host
- Primary
Active None
Other host -
Secondary
Failed Comm Failure 15:02:31 UTC Sep 21 2019
ciscoasa/pri/act(config)# sh ip
System IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0 fail-1 10.10.10.1 255.255.255.252 unset
Ethernet2 inside 192.168.0.254 255.255.255.0 manual
Ethernet3 dmz 192.168.2.254 255.255.255.0 manual
Ethernet4 outside 192.168.1.254 255.255.255.0 manual
Current IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0 fail-1 10.10.10.1 255.255.255.252 unset
Ethernet2 inside 192.168.0.254 255.255.255.0 manual
Ethernet3 dmz 192.168.2.254 255.255.255.0 manual
Ethernet4 outside 192.168.1.254 255.255.255.0 manual
ASA 2 –Secondary ASA Firewall Configuration
ciscoasa(config)# failover interface ip fail-1 10.10.10.1
255.255.255.252 standby 10.10.10.2
ciscoasa(config)# failover key cisco
ciscoasa(config)# failover lan unit secondary
ciscoasa(config)# failover
Detected an Active mate
Beginning configuration replication from mate.
ERROR: Password recovery was not changed, unable to
access
the configuration register.
Crashinfo is NOT enabled on Full Distribution
Environment
End configuration replication from mate.
ciscoasa/sec/stby(config)#
ciscoasa/sec/stby(config)# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0 fail-1 10.10.10.1 255.255.255.252 unset
Ethernet2 inside 192.168.0.254 255.255.255.0 CONFIG
Ethernet3 dmz 192.168.2.254 255.255.255.0 CONFIG
Ethernet4 outside 192.168.1.254 255.255.255.0 CONFIG
Current IP Addresses:
Interface Name IP address Subnet mask Method
Ethernet0 fail-1 10.10.10.2 255.255.255.252 unset
Ethernet2 inside 192.168.0.253 255.255.255.0 CONFIG
Ethernet3 dmz 192.168.2.253 255.255.255.0 CONFIG
Ethernet4 outside 192.168.1.253 255.255.255.0 CONFIG
ciscoasa/pri/act# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: fail-1 Ethernet0 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25
seconds
Interface Policy 1
Monitored Interfaces 3 of 60 maximum
failover replication http
Version: Ours 9.1(5)16, Mate 9.1(5)16
Last Failover at: 17:01:41 UTC Sep 21 2019
This host: Primary - Active
Active time: 98 (sec)
Interface inside (192.168.0.254): Normal (Monitored)
Interface dmz (192.168.2.254): Unknown (Waiting)
Interface outside (192.168.1.254): Unknown (Waiting)
Other host: Secondary - Standby Ready
Active time: 0 (sec)
Interface inside (192.168.0.253): Normal (Monitored)
Interface dmz (192.168.2.253): Unknown (Waiting)
Interface outside (192.168.1.253): Unknown (Waiting)
ciscoasa/sec/stby# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: fail-1 Ethernet0 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25
seconds
Interface Policy 1
Monitored Interfaces 3 of 60 maximum
failover replication http
Version: Ours 9.1(5)16, Mate 9.1(5)16
Last Failover at: 17:01:20 UTC Sep 21 2019
This host: Secondary - Standby Ready
Active time: 0 (sec)
Interface inside (192.168.0.253): Normal (Monitored)
Interface dmz (192.168.2.253): Unknown
(Waiting)
Interface outside (192.168.1.253): Unknown (Waiting)
Other host: Primary - Active
Active time: 145 (sec)
Interface inside (192.168.0.254): Normal (Monitored)
Interface dmz (192.168.2.254): Unknown (Waiting)
Interface outside (192.168.1.254): Unknown (Waiting)
Now NATING the inside network to the outside
ciscoasa/pri/act(config)# object network inside-net
ciscoasa/pri/act(config-network-object)# subn
ciscoasa/pri/act(config-network-object)# subnet
192.168.0.0 255.255.255.0
ciscoasa/pri/act(config-network-object)# nat
(inside,outside) dynamic interface
ciscoasa/pri/act(config)# policy-map global_policy
ciscoasa/pri/act(config-pmap)# class inspection_default
ciscoasa/pri/act(config-pmap-c)# inspect icmp
ciscoasa/pri/act(config)# ip route 0.0.0.0 0.0.0.0
192.168.1.1
NOW inside network can reach the internet and he
did ping successfully to www.google.com
When cpmare the asa firewalls active and standby
now, u will be sure that the stateful information replication happened
successfully. See the tcp and udp connections on both of the asa firewalls.
ciscoasa/pri/act# show failover
Failover On
Failover unit Primary
….
Stateful Failover Logical Update Statistics
Link :
fail-2 Ethernet1 (up)
Stateful Obj xmit xerr rcv rerr
General 95 0 33 0
sys
cmd 33
0 33 0
up
time 0 0 0 0
RPC
services 0 0 0 0
TCP
conn 12 0 0 0
UDP
conn 28 0
0 0
ARP
tbl 21 0 0 0
Xlate_Timeout 0 0 0 0
IPv6
ND tbl 0 0 0 0
VPN
IKEv1 SA 0 0 0 0
……
ciscoasa/sec/stby# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: fail-1 Ethernet0 (up)
…….
TCP
conn 0 0 12 0
UDP
conn 0 0 28 0
ARP tbl
0 0 21 0
……
Now I want to stop the active firewall manually
using the command no failover active
ciscoasa/pri/act(config)# no failover active
ciscoasa/pri/act(config)# Waiting for the earlier
webvpn instance to terminate...
Previous instance shut down. Starting a new one.
Switching to Standby
ciscoasa/pri/stby(config)#
This is a totally impressive story that everyone needs to inspect with gratefulness for sharing. Have you at any point searched for the online counter application for click counts and scores additionally visit the mouse click counter profile. singularities who concentrate on mantras and tasbih can utilize the application as a tasbih or mantra counter. The wash factor you need to do is to open the tool and click the counter button after each measuring meeting. utilizing this application, you may be sure music and keep your ordinary serenades.
ReplyDelete