ASA Failover模式

Posted 2020-09-29

根据运行模式来划分

The two units in a failover configuration must have the same hardware configuration. They must be the same model, have the same number and types of interfaces, and the same amount of RAM.

 

1.Active/Active Failover

 

Active/active 有什么优势?

1.2个units都可以承载流量,可以实现负载分担

2.将context划分成成逻辑的 failover groups,最多创建2个group, admin和unassigned contexts 都在group1

3.Active/active只能在multiple context mode下使用

 

 

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91336-pix-activeactive-config.html#act1

 

2.Active/Standby Failover

 

根据状态划分 Regular and Stateful Failover

 

1.Regular Failover

session会断开连接

 

2.Stateful Failover

session不会断开连接

 

 

根据Failover连接方式划分

 

1.Cable-Based Active/Active Failover

Specify the interface to be used as Stateful Failover link:

hostname(config)#failover link if_name phy_if

 

In this example, the Ethernet2 interface is used to exchange the stateful failover link state information.

failover link stateful Ethernet2

 

2.LAN-Based Active/Active Failover

Enable LAN-based failover:

hostname(config)#failover lan enable

 

Designate the unit as the primary unit:

hostname(config)#failover lan unit primary

 

Specify the failover link:

PIX1(config)#failover lan interface LANFailover ethernet3