Configuring Cisco ASA High-Availability (Active/Standby)
ฝัง
- เผยแพร่เมื่อ 31 ก.ค. 2020
- SUBSCRIBE - LIKE - HIT THE NOTIFICATIONS BELL
CCIE Security Links:
All CCNP/CCIE Security books to help you get certified: www.amazon.co.uk/shop/networkwiizkiid
CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide - amzn.to/2yF4GWU
Integrated Security Technologies and Solutions - Volume I: Cisco Security Solutions for Advanced Threat Protection with Next-Generation Firewall, ... Security (CCIE Professional Development) amzn.to/3awraa7
CCIE/CCNP Security SNCF 300-710: Todd Lammle Authorized amzn.to/3cJDLZ3
www.cisco.com/c/en/us/td/docs...
Useful links:
Fund me: t.co/Iva1Y3IchF
Website: www.networkwizkid.com
Twitter: iwiizkiid
Instagram: iwiizkiid - วิทยาศาสตร์และเทคโนโลยี
Geat video, Kevin! I would recommend setting up virtual MAC addresses as well on the monitored interfaces, as part of the failover configuration. There is a particular scenario where this would help: Because the ASAs share the MAC address of the active unit, if the active unit was down and the standby reloaded, the standby will become active but it will use its own MAC address instead of using the MAC address of the previous active unit. This will trigger the other network devices to update their ARP table.
Now, the ASA will send a gratuitous ARP - but not for static NATs, unfortunately! So you will have to update the ARP table on any device that has an ARP entry for a translated address from a static NAT. Alternatively, you can use this nice debug command for issuing a gratuitous ARP from the ASA: debug menu ipaddrutl 6 "X.X.X.X". (really helps if you don't have access to the other device, especially given the ARP default cache timer on switches/routers is 4h)
Worth trying this in a lab / next video. As a last note, I would recommend setting up the virtual MAC address at the interface level - I was getting into a bug when trying this with the failover mac-address command. Happy labbing!
Hey Eduard,
Thank you and thank you for watching and sharing that useful information.
Great video, you really explained how it worked. Many thanks!
Hi Bob, thank you for the feedback. I'm glad that you found it useful.
Thank you for watching.
Thanks -- great informative video with good tips --- incl. from Eduard Adam below -- showing great Respect..! Keep up the good work & knowledge share..!
No problem, thank you for watching.
Do we need to connect the inside and outside connection on the same physical interfaces for Active standby firewall? The problem is , from One Firewall I need to connect fibre connection and from the other firewall, I have to connect the copper connection for the same switch connection.
The same type of interfaces are required.
Please double-check the Cisco documentation for the version of software you are using.