ASA上配置ActiveActive Failover.docVIP

ASA上配置Active/Active Failover 文章摘要： ASA Active/Active Failover只能配置在多模式下 l 如下图配置 ASA ： Context Interface IP Address Nameif c1 e0 0 outside e1 10.1.1 .10 inside Context Interface IP Address Nameif c2 e0 0 outside e2 20.1.1 .10 insid ASA Active/Active Failover只能配置在多模式下 l 如下图配置ASA： Context Interface IP Address Nameif c1 e0 0 outside e1 0 inside Context Interface IP Address Nameif c2 e0 0 outside e2 0 inside l 使用E3口作为拷贝配置文件和状态信息的接口； l Failover IP地址为 ; l Failover key为ciscoask； 1.配置交换机 2.配置ASA1 基本配置同上，我们只配置A/A的Failover；注意：A/A的failover只运行在多模式防火墙上； asa1(config)# failover lan enable asa1(config)# failover lan unit primary asa1(config)# failover lan interface failover e3 INFO: Non-failover interface config is cleared on Ethernet3 and its sub-interfaces asa1(config)# failover link failover e3 asa1(config)# fail inter ip failover standby 192.1681.2 asa1(config)# failover key ciscoask //A/A的Failover是以Failover组来实现的，虚拟防火墙加入组，组在设备上为active，那么该虚拟防火墙就为active； asa1(config)# failover group 1 asa1(config-fover-group)# preempt //配置抢占 asa1(config-fover-group)# primary asa1(config)# failover group 2 asa1(config-fover-group)# preempt asa1(config-fover-group)# secondary asa1(config)# context c1 asa1(config-ctx)# join-failover-group 1 asa1(config)# context c2 asa1(config-ctx)# join-failover-group 2 asa1(config)#failover 2.配置ASA2 ASA2的Failover配置不变； 3.测试 在ASA1上show failover asa1(config)# show failover Failover On Cable status: N/A - LAN-based failover enabled Failover unit Primary Failover LAN Interface: failover Ethernet3 (up) Unit Poll frequency 15 seconds, holdtime 45 seconds Interface Poll frequency 5 seconds, holdtime 25 seconds Interface Policy 1 Monitored Interfaces 4 of 250 maximum Version: Ours 7.2(2), Mate 7.2(2) Group 1 last failover at: 21:48:59 UTC Dec 3 2007 Group 2 last failover at: 21:48:58 UTC Dec 3 2007 This host: Primary Group 1 State: Active Active time: 105 (sec) Group 2 State: Standby Ready