ASA Failover模式

根据运行模式来划分

The two units in a failover configuration must have the same hardware configuration. They must be the same model, have the same number and types of interfaces, and the same amount of RAM.

1.Active/Active Failover

Active/active 有什么优势?

1.2个units都可以承载流量,可以实现负载分担

2.将context划分成成逻辑的 failover groups,最多创建2个group, admin和unassigned contexts 都在group1

3.Active/active只能在multiple context mode下使用

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91336-pix-activeactive-config.html#act1

2.Active/Standby Failover

根据状态划分 Regular and Stateful Failover

1.Regular Failover

session会断开连接

2.Stateful Failover

session不会断开连接

根据Failover连接方式划分

1.Cable-Based Active/Active Failover

Specify the interface to be used as Stateful Failover link:

hostname(config)#failover link if_name phy_if

In this example, the Ethernet2 interface is used to exchange the stateful failover link state information.

failover link stateful Ethernet2

2.LAN-Based Active/Active Failover

Enable LAN-based failover:

hostname(config)#failover lan enable

Designate the unit as the primary unit:

hostname(config)#failover lan unit primary

Specify the failover link:

PIX1(config)#failover lan interface LANFailover ethernet3