ASA Active/Standby Failover Configuration

The fail-over configuration requires two identical security appliances connected to each other through a dedicated fail-over link and, optionally, a state full fail-over link. The health of the active interfaces and units is monitored to determine if specific fail-over conditions are met. If those conditions are met, fail-over occurs.

Active/Standby Fail-over lets you use a standby security appliance to take over the functionality of a failed unit. When the active unit fails, it changes to the standby state while the standby unit changes to the active state. The unit that becomes active assumes the IP addresses, or, for a transparent firewall, the management IP address, and MAC addresses of the failed unit and begins to pass traffic. 

First you should have two identical ASAs with fail-over feature enabled. you can verify it by issuing following command. If not you have purchase a license.

#show version

Primary Firewall 

1. Enable fail-over feature
FW01(config)#failover

2. Set FW as primary or secondary. FW01 configured as primary in given example.

FW01(config)#failover lan unit primary

3. Set the failover link which use to synchronize each other. Ge3 is configured as failover link and "failover-interface" is set as name of the interfaces in both FWs in given example.

FW01(config)#failover lan interface failover-interface GigabitEthernet3

4.Set failover interface primary and secondary ip addresses. 

FW01(config)#failover interface ip failover-interface 10.200.190.17 255.255.255.252 standby 10.200.190.18

Secondary Firewall 

1. Enable fail-over feature
FW02(config)#failover

2. Set FW as primary or secondary. FW02 configured as primary in given example.

FW02(config)#failover lan unit secondary

3. Set the failover link which use to synchronize each other. Ge3 is configured as failover link and "failover-interface" is set as name of the interfaces in both FWs in given example.

FW02(config)#failover lan interface failover-interface GigabitEthernet3

4.Set failover interface primary and secondary ip addresses. 

FW02(config)#failover interface ip failover-interface 10.200.190.17 255.255.255.252 standby 10.200.190.18

Done!!! :)

You can verify the whether it is working properly or not by issuing following command.

FW01# show failover state

FW02# show failover state

Continue reading

standby

Network and Service Object/Object Groups in ASA

 Network objects or object groups and service object or object groups are used for maintain and manage IPs and services more meaningful and easy way. Object can hold only one information related to ip or service and object group can hold many.

Network Objects

1. Create object with a meaningful object name using “object network” command. OBJ1 is given as       object name in given examples.

    hostname(config)# object network OBJ1

2. Give a meaningful description about the object. (optional)

    hostname (config-network-object)# description Engineering Network

3. Set ip details as required. Ip details can configure in four ways

    Note- you can only configure one line here

•  as a single ip – use host command with a ip address                                                         

           hostname (config-network-object)# host 10.2.2.2
 or

• as a network – use subnet command with network address and subnetmask                   

          hostname (config-network-object)# subnet  10.0.0.0 255.0.0.0
or

• as a range of ip – use range command with first ip and last ip                                     

          hostname(config-network-object)# range 10.0.0.1 10.0.0.255 
or

• as a FQDN – use fqdn command with full qualified domain name                                 

          hostname(config-network-object)# fqdn  ittipslk.blogspot.com

Network Object Groups

1. Use object-group network command with meaningful name. GRP1 is given as name in given               example.

    hostname (config)# object-group network GRP1

2. Give a meaningful description about the object. (optional)

    hostname (config-network)# description Administrator Addresses

3. Set ip details as required

Note- you can configure one or many lines here 

• Set ip single ip detail using network-object host commad with the ip address    

          hostname(config-network)#network-object host 10.2.2.4     

          hostname(config-network)#network-object host 10.2.2.5

• Set a previously created object inside object group using group-object command with object name 

          hostname(config-network)# group-object OBJ1

Service Objects

1. Create object with a meaningful object name using “object service” command. SER1 is given as         object name in given examples.

    hostname(config)# object service SER1

2. Set the service as required. You can use tcp/udp/icmp/icmp6 as protocols and eq/neq/lt/gt/range to     set port ranges

    Note- you can only configure one line here.

    examples...

• Set source port greater than or equal tcp/6785 and destination tcp/ssh   

          hostname(config-service-object)# service tcp source gt 6785 destination eq ssh 
or

• set destination ports from udp/53 to udp/63           

          hostname(config-service-object)# service udp destination range 53 63
or

• set icmp packet type 3 and code 1

          hostname(config-service-object)# service icmp 3 1

Service Object Group

1. Use object-group service command with meaningful name. GRP2 is given as name in given                 example.

    hostname(config)# object-group service GRP2

2. Give a meaningful description about the object. (optional)

    hostname(config-service-object-group)# description  Test ports

3. Set port details as required. You can use tcp/udp/tcp-udp as protocols and eq/neq/lt/gt/range to             set port ranges

    Note- you can configure one or many lines here

• Set source port greater than or equal tcp/1000 and destination tcp/ftp 

          hostname(config-service-object-group)# service-object source tcp gt 1000 destination tcp eq ftp

• Set destination ports  tcp/53 and udp/53        

          hostname(config-service-object-group)# service-object destination tcp-udp eq 53

• set source ports from tcp/50 to tcp/100     

          hostname(config-service-object-group)# service-object source tcp range 50 100

• The following example shows how to add an object to a service object group     

          hostname(config-service-object-group)# service-object object WEB

Continue reading

service object

VRRP and HSRP

The Virtual Router Redundancy Protocol (VRRP) is a computer networking protocol that provides for automatic assignment of available Internet Protocol (IP) routers to participating hosts. This increases the availability and reliability of routing paths via automatic default gateway selections on an IP subnetwork.

The Hot Standby Router Protocol (HSRP) is a Cisco proprietary redundancy protocol for

establishing a fault-tolerant default gateway.

Using the diagram above we are going to configure R02 and R03 for VRRP and HSRP using following ip plan.

	R02	R03
Fa 0/0 IP	200.100.1.2/30	200.100.1.3/30
Virtual IP	200.100.1.1/30

VRRP

1. First you need to enable vrrp feature

R02(config)#feature vrrp

2. Assign IP address to physical interface. Fa 0/0 is configure in given example.

R02(config)#interface fastEthernet  0/0R02(config-if)# ip address 200.100.1.2 255.255.255.252 

3. Configure vrrp with unique group no

R02(config-if)#vrrp 1

4. Set a description

R02(config-if)#vrrp 1 description ###########Test VRRP###############

5. Assign a priority level to Router. This will help two routers to decide who is master and who is slave. Router which has higher value act as master master and route the traffic. If no value has been configured then default value take as 100. Note that R02 is set as master in given example.

R02(config-if)#vrrp 1 priority 110 

6. Set the virtual IP. This is same for both devices.

R02(config-if)#vrrp 1 address 200.100.1.1   

7. Set a authentication type for security. Authentication type can be plain text or md5.This should be same in both routers.Note that text authentication configures in given example. 

text	vrrp 1 authentication text text-string	vrrp 1 authentication text-string
md5	vrrp 1 authentication md5 <key-chain/key-sring> key-chain-name/key-string

R02(config-if)#vrrp 1 authentication cisco123

8. Enable the interface

R02(config-if)#no shutdown

9.end :)

R02(config-if)#end

10. Do the same configuration for R03 with correct IPs and priority no

R03(config)#feature vrrp
R03(config)#interface fastEthernet  0/0
R03(config-if)# ip address 200.100.1.3 255.255.255.252 
R03(config-if)#vrrp 1
R03(config-if)#vrrp 1 description ###########Test VRRP###############
R03(config-if)#vrrp 1 priority 90
R03(config-if)#vrrp 1 address 200.100.1.1   
R03(config-if)#vrrp 1 authentication cisco123
R03(config-if)#no shutdown

R03(config-if)#end

HSRP

1. Assign IP address to physical interface. Fa 0/0 is configure in given example.            

R02(config)#interface fastEthernet  0/0R02(config-if)# ip address 200.100.1.2 255.255.255.252 

2. Configure hsrp with unique group no
R02(config-if)#standby 1

3. Set a description
R02(config-if)#standby 1 name ###########Test HSRP###############


4. Assign a priority level to Router. This will help two routers to decide who is master and who is slave. Router which has higher value act as master master and route the traffic. If no value has been configured then default value take as 100. Note that R02 is set as master in given example.
R02(config-if)#standby 1 priority 110 

5. Set the virtual IP. This is same for both devices.
R02(config-if)#standby 1 address 200.100.1.1  

6. Set a authentication type for security. Authentication type can be plain text or md5.This should be same in both routers.Note that text authentication configures in given example. 

text	standby 1 authentication text text-string	standby 1 authentication text-string
md5	standby 1 authentication md5 <key-chain/key-sring> key-chain-name/key-string

R02(config-if)#standby 1 authentication cisco123

7. Enable the interface
R02(config-if)#no shutdown

8.end :)
R02(config-if)#end

9. Do the same configuration for R03 with correct IPs and priority no
R03(config)#interface fastEthernet  0/0

R03(config-if)# ip address 200.100.1.3 255.255.255.252
R03(config-if)#standby 1
R03(config-if)#standby 1 name ###########Test HSRP###############
R03(config-if)#standby 1 priority 90
R03(config-if)#standby 1 address 200.100.1.1
R03(config-if)#standby 1 authentication cisco123
R03(config-if)#no shutdown
R03(config-if)#end

Continue reading

vrrp

Ether Channel Configuration on Cisco Switches

EtherChannel is a port link aggregation technology or port-channel architecture used primarily on Cisco switches. It allows grouping of several physical Ethernet links to create one logical Ethernet link for the purpose of providing fault-tolerance and high-speed links between switches, routers and servers.

Let's assume we are going to create an ether channel using  fast ethernet 0/1 to 0/4

1. First Create a port channel interface with unique no
SW1(config)# interface port-channel 1

2. Select the group of intefaces or interface which need to add into port channel

SW1(config)#interface range f0/1-4 

or

SW1(config)#interface f0/1

3. Add interface to created port channel no and select the mode. auto is set as mode in given example 

active     -  The interface starts negotiations with other interfaces by sending LACP packets.

passive    - The interface responds to LACP packets that it receives, but does not start LACP packet negotiation. This setting minimizes the transmission of LACP packets.

desirable - The interface starts negotiations with other interfaces by sending PAgP packets.

auto        - The interface responds to PAgP packets it receives but does not start PAgP packet negotiation. This setting minimizes the transmission of PAgP packets. 

on           - Forces the interface into an EtherChannel without PAgP or LACP. With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode.

SW1(config-if-range)#channel-group 1 mode auto

4. end :)

SW1(config-if-range)#end 

Continue reading

portchannel