php global.asa,ASA双链路SLA配置测试

一.概述：

实际工作中估计会经常碰到用ASA接两家ISP线路，比如电信和网通，而又没有足够的预算买负载均衡设备，但是又想实现链路负载分担和自动切换，从电信来的流量，从电信线路回去，从网通来的流量从网通线路回去，当其中一条线路出现故障时，所有的流量从没有出现故障线路走。

二.基本思路：

A.用OSPF模拟运营商网络，主要是为了不想手工添加路由

B.通过添加默认路由走电信线路、监控电信线路的网关，和高metric的默认路由走网通线路，实现：

—-电信来的流量走电信回去(需要C手工配置网通静态路由相配合)

—-电信链路出现故障时，走网通线路

C.通过添加网通的静态路由走网通线路，并监控网通线路的网关，实现：

—-网通来的流量走网通回去

—-网通链路出现故障时，走电信线路的默认路由

D.对于静态NAT,实际环境只有当两条ISP线路都正常时，才会同时能被访问

E.测试环境，实现静态NAT当一条线路出现故障时，还能同时被访问，实现的方法是：

—ASA两个外部接口配置两条静态NAT

—ASA两个相连的ISP路由器把另外一家ISP所NAT的网段发布出去，并将metric设置比OSPF默认的大

三.测试拓扑：

四.基本配置：

A.R1：

①接口配置：

interfaceLoopback0

ipaddress1.1.1.1255.255.255.0

interfaceLoopback61

ipaddress61.1.3.1255.255.255.0

ipospfnetworkpoint-to-point

interfaceLoopback202

ipaddress202.100.3.1255.255.255.0

ipospfnetworkpoint-to-point

interfaceFastEthernet0/0

ipaddress202.100.2.1255.255.255.0

noshut

interfaceFastEthernet0/1

ipaddress61.1.2.1255.255.255.0

noshut

②路由配置:

routerospf1

router-id1.1.1.1

passive-interfacedefault

nopassive-interfaceFastEthernet0/0

nopassive-interfaceFastEthernet0/1

network61.1.2.10.0.0.0area0

network61.1.3.10.0.0.0area0

network202.100.2.10.0.0.0area0

network202.100.3.10.0.0.0area0

B:R2：

①接口配置：

interfaceLoopback0

ipaddress2.2.2.2255.255.255.0

interfaceFastEthernet0/0

ipaddress202.100.1.2255.255.255.0

noshut

interfaceFastEthernet0/1

ipaddress202.100.2.2255.255.255.0

noshut

interfaceFastEthernet1/0

ipaddress23.1.1.1255.255.255.252

noshut

②路由配置：

routerospf1

router-id2.2.2.2

log-adjacency-changes

passive-interfacedefault

nopassive-interfaceFastEthernet0/1

nopassive-interfaceFastEthernet1/0

network23.1.1.10.0.0.0area0

network202.100.1.20.0.0.0area0

network202.100.2.20.0.0.0area0

C.R3:

①接口配置：

interfaceLoopback0

ipaddress3.3.3.3255.255.255.0

interfaceFastEthernet0/0

ipaddress61.1.1.3255.255.255.0

noshut

interfaceFastEthernet0/1

ipaddress61.1.2.3255.255.255.0

noshut

interfaceFastEthernet1/0

ipaddress23.1.1.2255.255.255.252

noshut

②路由配置：

routerospf1

router-id3.3.3.3

passive-interfacedefault

nopassive-interfaceFastEthernet0/1

nopassive-interfaceFastEthernet1/0

network23.1.1.20.0.0.0area0

network61.1.1.30.0.0.0area0

network61.1.2.30.0.0.0area0

D.ASA842:

①接口配置：

interfaceGigabitEthernet0

nameifInside

security-level100

ipaddress10.1.1.10255.255.255.0

noshut

interfaceGigabitEthernet1

nameifOutside

security-level0

ipaddress202.100.1.10255.255.255.0

noshut

interfaceGigabitEthernet2

nameifBackup

security-level0

ipaddress61.1.1.10255.255.255.0

noshut

②两条线路的动态PAT配置：

objectnetworkinside_net

subnet0.0.0.00.0.0.0

objectnetworkinside_any

subnet0.0.0.00.0.0.0

objectnetworkinside_net

nat(Inside,Outside)dynamicinterface

objectnetworkinside_any

nat(Inside,Backup)dynamicinterface

③两条线路的静态NAT配置：

objectnetworkInside_host_outside

host10.1.1.4

objectnetworkInside_host_backup

host10.1.1.4

objectnetworkOutside-to-backup

host10.1.1.4

objectnetworkBackup-to-outside

host10.1.1.4

objectnetworkInside_host_outside

nat(Inside,Outside)static202.100.1.4

objectnetworkInside_host_backup

nat(Inside,Backup)static61.1.1.4

objectnetworkOutside-to-backup

nat(Inside,Outside)static61.1.1.4

objectnetworkBackup-to-outside

nat(Inside,Backup)static202.100.1.4

—-每条线路配置两条NAT,保证一条ISP线路出现故障时，两条静态NAT都能被访问

④防火墙策略配置：

class-mapALL_IP

matchany

policy-mapglobal_policy

classinspection_default

inspecticmp

classALL_IP

setconnectiondecrement-ttl

service-policyglobal_policyglobal

access-listoutsideextendedpermiticmpanyany

access-listoutsideextendedpermitudpanyanyrange3343433523

access-listoutsideextendedpermittcpanyobjectInside_host_outsideeqtelnet

access-groupoutsideininterfaceOutside

access-groupoutsideininterfaceBackup

E:R4:

①接口配置：

interfaceLoopback0

ipaddress192.168.1.4255.255.255.0

interfaceFastEthernet0/0

ipaddress10.1.1.4255.255.255.0

noshut

②路由配置：

iproute0.0.0.00.0.0.010.1.1.10

③telnet配置：

linevty04

passwordcisco

login

五.ASA842SLA及路由配置：

①sla配置：

slamonitor1

typeechoprotocolipIcmpEcho202.100.1.2interfaceOutside

frequency10

slamonitorschedule1lifeforeverstart-timenow

slamonitor2

typeechoprotocolipIcmpEcho61.1.1.3interfaceBackup

frequency10

slamonitorschedule2lifeforeverstart-timenow

②track配置：

track1rtr1reachability

track2rtr2reachability

③静态路由配置：

routeoutside00202.100.1.21track1

routebackup0061.1.1.3254

—默认路由走电信线路，当电信线路出现故障时自动切换到网通线路

routeBackup61.1.2.0255.255.255.061.1.1.31track2

routeBackup61.1.3.0255.255.255.061.1.1.31track2

—当网通线路正常时，到网通的网络的数据走网通的线路，否则走电信的默认路由

routeInside192.168.1.0255.255.255.010.1.1.41

—增加一条回指路由

六.关于静态NAT：

—为了使两条线路其中一条线路出现故障时，两个被静态NAT地址都能访问，需要：

A.每条线路配置两条静态NAT

—-前面已经配置

B.每个相连的ISP路由器把另外一家ISP所NAT的网段发布出去，并将metric设置比ospf默认的大

—-这种情况在实际环境基本无法实现，两家ISP不可能会帮客户做这样的事情，除非给的费用足够多

—-测试环境下还是可以玩一玩的

①R2路由器：

iproute61.1.1.0255.255.255.0202.100.1.10254tag10

route-mapASA842permit10

matchtag10

routerospf1

redistributestaticmetric130subnetsroute-mapASA842

②R3路由器：

iproute202.100.1.0255.255.255.061.1.1.10254tag10

route-mapASA842permit10

matchtag10

routerospf1

redistributestaticmetric130subnetsroute-mapASA842

七.效果测试：

A.线路正常的情况下：

R4#traceroute202.100.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto202.100.3.1

1202.100.1.2160msec108msec56msec

2202.100.2.136msec*24msec

R4#traceroute61.1.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto61.1.3.1

161.1.1.3112msec8msec0msec

261.1.2.1112msec*68msec

—去电信的流量走电信，去网通的流量走网通

R1#traceroute202.100.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

1202.100.2.232msec56msec20msec

2202.100.1.1040msec*24msec

3202.100.1.480msec*16msec

R1#traceroute202.100.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

1202.100.2.2140msec180msec80msec

2202.100.1.1064msec*88msec

3202.100.1.4140msec*84msec

R1#traceroute61.1.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

161.1.2.3116msec32msec0msec

261.1.1.104msec*4msec

361.1.1.4208msec*128msec

R1#traceroute61.1.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

161.1.2.38msec120msec192msec

261.1.1.100msec*20msec

361.1.1.4152msec*204msec

—-两个被静态NAT地址都能被访问，并且电信的地址走电信接口，网通的地址走网通的接口

B.电信线路不正常的情况下：

R4#traceroute202.100.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto202.100.3.1

110.1.1.10188msec*28msec

261.1.1.344msec0msec0msec

361.1.2.1108msec*84msec

R4#traceroute61.1.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto61.1.3.1

110.1.1.100msec*20msec

261.1.1.3100msec32msec0msec

361.1.2.1108msec*72msec

—去电信和网通的流量都走网通

R1#traceroute202.100.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

161.1.2.34msec184msec52msec

261.1.1.100msec*0msec

3202.100.1.4152msec*12msec

R1#traceroute202.100.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

161.1.2.336msec4msec16msec

261.1.1.10200msec*16msec

3202.100.1.4184msec*148msec

R1#traceroute61.1.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

161.1.2.348msec0msec0msec

261.1.1.104msec*32msec

361.1.1.4148msec*180msec

R1#traceroute61.1.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

161.1.2.376msec52msec0msec

261.1.1.100msec*16msec

361.1.1.4172msec*112msec

—-电信和网通被静态NAT的地址都能被电信和网通的用户访问

C.网通线路不正常的情况下：

R4#traceroute202.100.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto202.100.3.1

110.1.1.108msec*28msec

2202.100.1.2108msec72msec84msec

3202.100.2.188msec*128msec

R4#traceroute61.1.3.1sourcel0

Typeescapesequencetoabort.

Tracingtherouteto61.1.3.1

110.1.1.100msec*76msec

2202.100.1.2112msec96msec24msec

3202.100.2.1248msec*76msec

—去电信和网通的流量都走电信

R1#traceroute202.100.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

1202.100.2.24msec156msec76msec

2*

202.100.1.1040msec*

3202.100.1.468msec*24msec

R1#traceroute202.100.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto202.100.1.4

1202.100.2.292msec60msec124msec

2202.100.1.104msec*36msec

3202.100.1.4152msec*60msec

R1#traceroute61.1.1.4sourcel61

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

1202.100.2.232msec136msec116msec

2202.100.1.1080msec*56msec

361.1.1.4120msec*120msec

R1#traceroute61.1.1.4sourcel202

Typeescapesequencetoabort.

Tracingtherouteto61.1.1.4

1202.100.2.24msec140msec112msec

2202.100.1.1064msec*64msec

361.1.1.4156msec*80msec

—-电信和网通被静态NAT的地址都能被电信和网通的用户访问