思科ASA防火墙双机热备综合实验

一、实验背景：
Failover特性是Cisco安全产品高可用性的一个解决方案，目的是为了提供不间断的服务，当主设备down掉的时候，备用设备能够马上接管主设备的工作，进而保持通信的连通性；Failover配置要求两个进行Failover的设备通过专用的failover线缆和可选的Stateful Failover线缆互相连接；活动设备的接口被monitor，用于发现是否要进行Failover，切换Failover分为failover和Stateful Failover，即故障切换和带状态的故障切换。
不带状态的failover在进行切换的时候，所有活动的连接信息都会丢失，所有Client都需要重新建立连接信息，那么这会导致流量的间断。
带状态的failover，主设备将配置信息拷贝给备用设备的同时，也会把自己的连接状态信息拷贝给备用设备，那么当主的设备down的时候，由于备用设备上保存有连接信息，因此Client不需要重新建立连接，那么也就不会导致流量的中断。
Failover link
两个failover设备频繁的在failover link上进行通信，进而检测对等体的状态。以下信息是通过failover link通信的信息：
设备状态（active or standby）；
电源状态（只用于基于线缆的failover；）
Hello messages （keep-alives）；
Network link 状态；
MAC地址交换；
配置的复制和同步；
（Note ：所有通过failover 和stateful failover线缆的信息都是以明文传送的，除非你使用failover key来对信息进行加密；）
Stateful link
在stateful link上，拷贝给备用设备的连接状态信息有：
NAT 转换表；
TCP连接状态；
UDP连接状态；
ARP表
2层转发表（运行在透明模式的时候）
HTTP连接状态信息（如果启用了HTTP复制）
ISAKMP和IPSec SA表
GTP PDP连接数据库
以下信息不会拷贝给备用设备：
HTTP连接状态信息（除非启用了HTTP复制）
用户认证表（uauth）
路由表

二、实验拓扑：

三、实验目标
1、在主墙上增加策略，配置和会话可同步到备墙，且只可以在主墙上增加策略，备墙无法增加配置和策略
2、实现双机热备的功能，关闭主防火墙，备墙切换为主状态，业务恢复
3、关闭IPS上联的e0/1口，此时主防火墙的Gi0/1状态仍为UP，实现主备墙的切换
四、实验环境
1、基于EVE-NG模拟器
2、防火墙使用ASA型号，版本为Version 9.8(1)
3、交换机使用二层交换机镜像
4、IPS为透明模式，使用交换机的镜像模拟，工作在二层
五、开始配置
1、交换机
SW1：
Vlan 2
vlan 4
interface Ethernet0/0
switchport access vlan 2
switchport mode access
interface Ethernet0/1
switchport access vlan 4
switchport mode access
interface Ethernet0/3
switchport trunk encapsulation dot1q
switchport mode trunk
interface Vlan2
ip address 12.1.1.4 255.255.255.0
vrrp 2 ip 12.1.1.6
vrrp 2 priority 120
interface Vlan4
ip address 14.1.1.1 255.255.255.0
vrrp 4 ip 14.1.1.3
vrrp 4 priority 120
!
ip route 0.0.0.0 0.0.0.0 12.1.1.1
SW2：
interface Ethernet0/0
switchport access vlan 2
switchport mode access
interface Ethernet0/1
switchport access vlan 4
switchport mode access
interface Ethernet0/3
switchport trunk encapsulation dot1q
switchport mode trunk
interface Vlan2
ip address 12.1.1.5 255.255.255.0
vrrp 2 ip 12.1.1.6
interface Vlan4
ip address 14.1.1.2 255.255.255.0
vrrp 4 ip 14.1.1.3
ip route 0.0.0.0 0.0.0.0 12.1.1.1
IPS(交换机模拟）：
interface Ethernet0/0
switchport access vlan 2
switchport mode access
duplex auto
!
interface Ethernet0/1
switchport access vlan 2
switchport mode access
duplex auto
!
2、思科ASAv
ASAv-01:
hostname ASA-01
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 13.1.1.1 255.255.255.0 standby 13.1.1.2
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 12.1.1.1 255.255.255.0 standby 12.1.1.2
!
interface GigabitEthernet0/5
description STATE Failover Interface // 要no shut接口才生效，这个就不多解析了，此接口用来同步会话
!
interface GigabitEthernet0/6
description LAN Failover Interface // 要no shut接口才生效，这个就不多解析了，此接口用来同步配置
!
failover
failover lan unit primary // 设置ASA1为主设备，并且用的是网线互联
failover lan interface ha GigabitEthernet0/6 // 设置failover的接口，此接口用来检测心跳和同步配置
failover interface ip ha 1.1.1.1 255.255.255.0 standby 1.1.1.2 // 设置failover主备地址
如果要减少失效切换期间的报文丢失，以及避免重建会话，需要使用stateful的全状态failover监控，必需用1条单独的链路专门负责同步状态数据库，添加以下配置使接口e0/5专门用于同步状态（记得先配置接口no shutdown）
failover link stateful GigabitEthernet0/5 // stateful端口命名为stateful，对应端口GigabitEthernet0/5，和failover非同一接口
failover interface ip stateful 2.1.1.1 255.255.255.0 standby 2.1.1.2 // 设置failover link主备地址
object network obj_14.1.1.100
host 14.1.1.100
object network obj_13.1.1.200
host 13.1.1.200
nat (inside,outside) source static obj_14.1.1.100 obj_14.1.1.100 destination static obj_13.1.1.200 obj_13.1.1.200 no-proxy-arp route-lookup
access-list 101 extended permit ip any any
access-group 101 in interface outside // 放行流量通过,这是基本配置了
route inside 14.1.1.0 255.255.255.0 12.1.1.6 1 //配置路由
ASAv-02:
hostname ASA-02
interface GigabitEthernet0/6
no shutdown
failover lan unit secondary
failover lan interface ha GigabitEthernet0/6
failover interface ip ha 1.1.1.1 255.255.255.0 standby 1.1.1.2
failover
注明： secondary的配置(只需要配置failover接口，其他都会从primary学习到,包括对于state link的配置，都不需要在secondary的ASA上做配置，直接从primary ASA上同步学习到)
3、其它
客户机Client：
IP地址：13.1.1.100/24
网关：13.1.1.1
服务器Server：
IP地址：14.1.1.100/24
网关：14.1.1.3
六、实验现象
实验现象一、在主墙上增加策略，配置和会话可同步到备墙，且只可以在主墙上增加策略，备墙无法增加策略
1、在主墙上添加策略，备墙自动同步配置。
ASA-01# access-list 101 extended permit ip any any
access-group 101 in interface outside

2、尝试在备墙上添加route inside 14.1.1.0 255.255.255.0 12.1.1.6 1，备墙提示报错，说明只能在主墙增加策略。

3、在14.1.1.100服务器上ping Client(13.1.1.100)，同时查看主墙和备墙的会话表，主备墙会话可自动同步。
Server> ping 13.1.1.100 -t
84 bytes from 13.1.1.100 icmp_seq=1 ttl=254 time=6.526 ms
84 bytes from 13.1.1.100 icmp_seq=2 ttl=254 time=7.419 ms
84 bytes from 13.1.1.100 icmp_seq=3 ttl=254 time=8.079 ms
ASA-01# show conn
12 in use, 14 most used
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43734, idle 0:00:00, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43478, idle 0:00:01, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43734, idle 0:00:00, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43478, idle 0:00:01, bytes 56, flags
ASA-02# show conn
12 in use, 14 most used
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43734, idle 0:00:00, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43478, idle 0:00:01, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43734, idle 0:00:00, bytes 56, flags
ICMP outside 13.1.1.100:0 inside 14.1.1.100:43478, idle 0:00:01, bytes 56, flags
实验现象二、实现双机热备的功能，关闭主防火墙，备墙切换为主状态，业务恢复
1、关闭主墙前，先查看主墙的failover状态
ASA-01# show failover
Failover On
Failover unit Primary
Failover LAN Interface: ha GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.8(1), Mate 9.8(1)
Serial Number: Ours 9AU27R1A8HW, Mate 9ABM85BFRRC
Last Failover at: 10:36:34 UTC Mar 9 2019
This host: Primary - Active
Active time: 16401 (sec)
slot 0: empty
Interface outside (13.1.1.1): Normal (Monitored)
Interface inside (12.1.1.1): Normal (Monitored)
Other host: Secondary - Standby Ready
Active time: 0 (sec)
Interface outside (13.1.1.2): Normal (Monitored)
Interface inside (12.1.1.2): Normal (Monitored)

Stateful Failover Logical Update Statistics
Link : stateful GigabitEthernet0/5 (up)
Stateful Obj xmit xerr rcv rerr
General 2196 0 2191 0
sys cmd 2191 0 2191 0
up time 0 0 0 0
2、关闭主墙前，查看备墙的failover状态
ASA-01# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: ha GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.8(1), Mate 9.8(1)
Serial Number: Ours 9ABM85BFRRC, Mate 9AU27R1A8HW
Last Failover at: 10:36:24 UTC Mar 9 2019
This host: Secondary - Standby Ready
Active time: 0 (sec)
slot 0: empty
Interface outside (13.1.1.2): Normal (Monitored)
Interface inside (12.1.1.2): Normal (Monitored)
Other host: Primary - Active
Active time: 16466 (sec)
Interface outside (13.1.1.1): Normal (Monitored)
Interface inside (12.1.1.1): Normal (Monitored)

Stateful Failover Logical Update Statistics
Link : stateful GigabitEthernet0/5 (up)
Stateful Obj xmit xerr rcv rerr
General 2201 0 2204 2
sys cmd 2201 0 2201 0
up time 0 0 0 0
3、关闭主墙，备墙变为active状态，上下联接口地址进入转发状态。
ASA-01# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: ha GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.8(1), Mate 9.8(1)
Serial Number: Ours 9ABM85BFRRC, Mate 9AU27R1A8HW
Last Failover at: 15:15:21 UTC Mar 9 2019
This host: Secondary - Active //状态从备变为主
Active time: 10 (sec) //成为活跃状态时间为10s
slot 0: empty
Interface outside (13.1.1.1): Normal (Waiting)
Interface inside (12.1.1.1): Normal (Waiting)
Other host: Primary - Failed //对端主墙状态为failed
Active time: 16662 (sec)
Interface outside (13.1.1.2): Unknown (Monitored)
Interface inside (12.1.1.2): Unknown (Monitored)

Stateful Failover Logical Update Statistics
Link : stateful GigabitEthernet0/5 (up)
Stateful Obj xmit xerr rcv rerr
General 2228 0 2230 2
sys cmd 2228 0 2227 0
up time 0 0 0 0
实验现象三、关闭IPS上联的e0/1口，此时主防火墙的G1/0/0状态仍为UP，主备墙自动切换,主墙能自动检测上联接口的发包流量，检测不到流量则主状态切回备状态。
1、使用failover active 命令把主墙切回active状态，关闭IPS的上联接口，查看主墙的failover相关状态
ASA-01# show failover
Failover On
Failover unit Primary
Failover LAN Interface: ha GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.8(1), Mate 9.8(1)
Serial Number: Ours 9AU27R1A8HW, Mate 9ABM85BFRRC
Last Failover at: 15:21:14 UTC Mar 9 2019
This host: Primary - Failed //主墙检测到对端线路故障，状态改为failed
Active time: 108 (sec)
slot 0: empty
Interface outside (13.1.1.2): Normal (Waiting)
Interface inside (12.1.1.2): Failed (Waiting)
Other host: Secondary - Active //备墙变为主状态
Active time: 11 (sec)
Interface outside (13.1.1.1): Normal (Waiting)
Interface inside (12.1.1.1): Normal (Waiting)
2、查看备墙的failover状态
ASA-01# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: ha GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.8(1), Mate 9.8(1)
Serial Number: Ours 9ABM85BFRRC, Mate 9AU27R1A8HW
Last Failover at: 15:21:13 UTC Mar 9 2019
This host: Secondary - Active // 备墙变为主状态
Active time: 183 (sec)
slot 0: empty
Interface outside (13.1.1.1): Normal (Monitored)
Interface inside (12.1.1.1): Normal (Waiting)
Other host: Primary - Failed
Active time: 108 (sec)
Interface outside (13.1.1.2): Normal (Monitored)
Interface inside (12.1.1.2): Failed (Waiting)