ASA Traffic Zone

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/release/notes/asarn93.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/general/asa-general-cli/interface-zones.html

1.non-zone base Load balance

 

算法:Traffic is distributed among the specified gateways based on an algorithm that hashes the source and destination IP addresses

会有什么问题?

1.不一致路由  connnection table不一样  一个interface base 一个zone base

2.路由消失后对connection的处理  一个重传 一个保持

3.负载均衡的方式   一个  一个借口多个网关   多个接口多个网关

2.Zone base Load balance

难道是完美的解决方案吗? 有什么缺点?

The ASA load balances connections across equal cost routes using a hash made from the packet 6-tuple (source and destination IP address, source and destination port, protocol, and ingress interface).

一元组负载均衡

https://supportforums.cisco.com/document/59986/loadbalancing-dual-isp-asa

ECMP Load-Balancing Algorithms  负载均衡的算法

For Load Balance, select one of the following options from the Method drop-down:

 

IP Modulo —By default, the virtual router load balances sessions using this option, which uses a hash of the source and destination IP addresses in the packet header to determine which ECMP route to use.

IP Hash —Uses a hash of the source and destination IP addresses and optionally the source and destination port numbers in the packet header to determine which ECMP route to use. Specify options in Step 5 below.

Balanced Round Robin —Uses round robin among the ECMP paths and re-balances paths when the number of paths changes.

Weighted Round Robin —Uses round robin and a relative weight to select from among ECMP paths. Specify the weights in Step 6 below.

traffic-zone 对SLA的影响?

如何监测流量是否被负载均衡?

-show conn zone

-show asp table zone

-show local-host zone

-show route zone

-show asp table routing

-show interface ( check the traffic in zone interfaces)

时间: 2024-10-11 21:33:49

ASA Traffic Zone的相关文章

ASA - Handing Traffic

Topics: Handing Fragmented Traffic: reassemble all the fragments of a packet to inspect the contents Prioritizng Traffic: Controlling Traffic Bandwidth: Traffic Policing && Traffic shaping Packets coming into an ASA may be fragmented or whole. The

Cisco ASA U-Turn traffic.

我们的今天的目标是用思科anyconnect 远程登陆到ASA8,然后通过IPSEC×××连接到ASA9后面的10.2.0.10 远程用户连接到ASA8,得到(10.255.255.X)段的地址ASA8 (10.1.0.0/24) --- IPSEC××× ----- ASA9 (10.2.0.0/24) ASA8 的配置object-group network IPSEC-AMAZON-LOCALnetwork-object 10.1.0.0 255.255.255.0network-obje

Cisco ASA - Permit/Deny Traffic Domain name FQDN

refer to:https://www.fir3net.com/Firewalls/Cisco/cisco-asa-domain-fqdn-based-acls.html dns domain-lookup outside DNS server-group China_Telecom_SH_DNS name-server 202.96.209.133 202.96.209.5 domain-name Oneitc.local object network obj-i1.mallcoo.cn f

ASA基于用户的MPF 、高级访问控 制和地址转换_05

基于用户的MPF username user1 password cisco  username user2 password cisco   ! !创建两个账号给用户认证用   object-group user group1   ! !创建一个对象组    user Local\user1  ! !匹配本地数据的用户,也可以是ACS.   object-group user group2   user Local\user2  access-list 100 extended permit 

Inspecting Traffic

Topics Understanding the Modular Policy Framework:an overview of a flexible and organized method to configure security policies for a variety of Cisco ASA features Configuring the MPF Configuring a policy for Inspecting OSI Layers 3 and 4 Configuring

在Cisco ASA上实验 使用RRI的全互连Site to Site IPSec VPN

拓扑图如上. 说明:ASA1.2.3模拟分支边界网关,并启用PAT.R1.2.3模拟各内网设备. 要求:在ASA1.2.3上配置Site to Site VPN,实现全互联并配置反向路由注入(RRI),R1.2.3可以使用私有IP加密通信,不要求使用loopback IP通信:R1.2.3上有去往各私网的路由(通过RRI). 配置如下: ASA1: ciscoasa>en   ciscoasa# conf t //基本配置部分 ciscoasa(config)# hostname ASA1 AS

ASA - IPsec VPN

Topics Configuration Procedures, Deployment Strategies, and Information Gathering Configuring a Basic IPsec Site-to-Site VPN Configuring Advanced Authentication for IPsec Site-to-Site VPNs Troubleshooting an IPsec Site-to-Site VPN Part 1: Configurati

Recording ASA Activity

Overview: System Time: local && NTP Managing Event and Session Logging Configuring Event and Session Logging Verifying Event and Session Logging Troubleshooting Event and Session Logging Effective troubleshooting of network or device activity, fro

ASA不同level接口的访问

不同Level接口的NAT访问 Problem Description You config policy nat in ASA but failed. your config: nat (vpnnetwork) 3 access-list CenteneWeb-acl global (inside) 3 172.21.106.21 interface vpnnetwork security level:60 interface inside security level:100 Trouble