Cisco PIX 525 Especificaciones descargar pdf (Pagina 163)

100

101

11-31

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 11 Configuring Failover

Configuring Failover

You can prevent the return packets from being dropped using the asr-group command on interfaces

where this is likely to occur. With the asr-group command configured on an interface, the interface

connection information is sent to the failover peer. If the peer receives a packet for which it does not have

an active connection, it looks for a corresponding connection on the other interfaces in the asynchronous

routing group. If there is an active connection for it on its peer, it will forward the packet, and any others

it receives for that connection, to the peer unit where the connection is active until the connection is

terminated.

Note Using the asr-group command to configure asymmetric routing support is more secure than using the

static command with the nailed option.

Enter the following commands to configure asymmetric routing support. The asr-group command is

only available in the security contexts. Stateful failover must be enabled for asymmetric routing to

function properly.

hostname/ctx1(config)# interface

phy_if

hostname/ctx1(config-if)# asr-group

num

Valid values for num range from 1 to 32. You need to enter the command for each interface that will

participate in the asymmetric routing group. You can view the number of ASR packets transmitted,

received, or dropped by an interface using the show interface detail command.

Figure 11-1 shows an example of using the asr-group command for asymmetric routing support.

Figure 11-1 ASR Example

Context A is active on one unit and context B is active on the other. Each context has an interface named

“outside”, both of which are configured as part of asr-group 1. The outbound traffic is routed through

the unit where context A is active. However, the return traffic is being routed through the unit where

context B is active. Normally, the return traffic would be dropped because there is no session information

for the traffic on the unit. However, because the interface is configured with an asr-group number, the

132184

ISP A

Inside

network

Failover/State link

Context A

interface Ethernet4

nameif outside

asr-group 1

Context B

interface Ethernet2

nameif outside

asr-group 1

Outbound Traffic

Return Traffic

ISP B

1 2 ... 158 159 160 161 162 163 164 165 166 167 168 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 163

Comentarios a estos manuales