虚拟防火墙实验

1：虚拟防火墙

1.4 虚拟防火墙实验

1）实验拓扑

2）实验需求

2.1)首先完成交换网络的VLAN 和TRUNK 设置，保证连通性

2.2）ASA1 要求是HR 部分的主防火墙，ASA2 是备份
ASA2 要求是ENG 部分的主防火墙，ASA1 是备份

2.3）要求R1 R2 身后的网络可以自如的访问3.3.3.3

3）实验步骤

步骤1：完成所有路由器的配置

步骤2：完成交换机的VLAN 和TRUNK 设置

SW1

1 VLAN 10

2 VLAN 20

3 4 TRUNK

57 VLAN 22

68 VLAN 33

SW2

1 2 3 TRUNK

步骤3：防火墙上输入序列号，激活故障倒换和虚拟防火墙

activation-key 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5

步骤4：将防火墙的模式切换到多模式

ciscoasa(config)# mode multiple

步骤5：将防火墙所有接口全部激活

不要命名，不要添加IP

步骤6：在防火墙上设置逻辑子接口

不添加IP

步骤7：完成虚拟防火墙配置

7.1 查看现存的虚拟防火墙信息

ciscoasa# show context

Context Name Class Interfaces URL

*admin default disk0:/admin.cfg

 

Total active Security Contexts: 1

!!注意

系统自建的ADMIN 虚拟防火墙实际上是用来管理所有其它虚拟防火墙的

7.2 创建虚拟防火墙

ASA1/ ASA2

context ENG

allocate-interface GigabitEthernet0.100 outside

allocate-interface GigabitEthernet1.10 inside

config-url disk0:/ENG.cfg

!

 

context SALE

allocate-interface GigabitEthernet0.200 outside

allocate-interface GigabitEthernet1.20 inside

config-url disk0:/SALE.cfg

7.3 进入虚拟防火墙完成防火墙常规配置

ASA1 ENG 虚拟防火墙

!

hostname ENG

!

interface inside

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2

!

interface outside

nameif outside

security-level 0

ip address 100.100.100.1 255.255.255.0 standby 100.100.100.2

!

object network INSIDE

subnet 10.1.1.0 255.255.255.0

object-group network G

network-object object INSIDE

nat (inside,outside) source dynamic G interface

access-list FO extended permit icmp any any echo-reply

access-group FO in interface outside

route outside 0.0.0.0 0.0.0.0 100.100.100.3 1

route inside 10.1.1.0 255.255.255.0 192.168.1.3 1

 

ASA1 SALE

!

hostname SALE

!

interface inside

nameif inside

security-level 100

ip address 192.168.2.1 255.255.255.0 standby 192.168.2.2

!

interface outside

nameif outside

security-level 0

ip address 200.200.200.1 255.255.255.0 standby 200.200.200.2

!

object network INSIDE

subnet 20.2.2.0 255.255.255.0

object-group network G

network-object object INSIDE

nat (inside,outside) source dynamic G interface

access-list FO extended permit icmp any any echo-reply

access-group FO in interface outside

route outside 0.0.0.0 0.0.0.0 200.200.200.3

route inside 20.2.2.0 255.255.255.0 192.168.2.3

 

此时R1 R2 带着源PING 3.3.3.3 流量经过ASA 1 的两个虚拟防火墙都是可达的。

 

7.4 故障倒换的配置，实现虚拟防火墙的AA 故障倒换

！！注意

故障倒换并不是配置在自创的虚拟防火墙下的，

是在ADMIN 下配置

ASA1

failover lan unit primary

failover lan interface LAN GigabitEthernet2

failover link LINK GigabitEthernet3

failover interface ip LAN 172.16.12.1 255.255.255.0 standby 172.16.12.2

failover interface ip LINK 172.16.21.1 255.255.255.0 standby 172.16.21.2

failover group 1

preempt

failover group 2

secondary

preempt

!

context ENG

join-failover-group 1

context SALE

join-failover-group 2

 

ASA2

failover lan unit secondary

failover lan interface LAN GigabitEthernet2

failover link LINK GigabitEthernet3

failover interface ip LAN 172.16.12.1 255.255.255.0 standby 172.16.12.2

failover interface ip LINK 172.16.21.1 255.255.255.0 standby 172.16.21.2

 

7.5 启用故障倒换，确认A/A 模式虚拟防火墙工作

ASA1 ASA 2

(config)# failover

此时校验是否实现了A/A

 

ASA1

ciscoasa# show failover

……………………………………

 

This host: Primary

Group 1 State: Active

Active time: 86 (sec)

Group 2 State: Standby Ready

Active time: 0 (sec)

………………………………………………

 

ASA2

ciscoasa# show failover

………………………………

 

This host: Secondary

Group 1 State: Standby Ready

Active time: 0 (sec)

Group 2 State: Active

Active time: 126 (sec)

……………………………………