ASA842雙鏈路SLA配置測試

一.概述：

實際工作中估計會碰到需要用一臺ASA接兩家ISP線路，比如電信和網通，而又沒有足夠的預算買負載均衡設備，但是又想實現鏈路負載分擔和自動切換，從電信來的流量，從電信線路回去，從網通來的流量從網通線路回去，當其中一條線路出現故障時，所有的流量從沒有出現故障線路走。
二.基本思路：
A.用OSPF模擬運營商網絡，主要是為了不想手工添加路由

B.通過添加默認路由走電信線路、監控電信線路的網關，和高metric的默認路由走網通線路，實現：

----電信來的流量走電信回去（需要C手工配置網通靜態路由相配合）

----電信鏈路出現故障時，走網通線路

C.通過添加網通的靜態路由走網通線路，并監控網通線路的網關，實現：

----網通來的流量走網通回去

----網通鏈路出現故障時，走電信線路的默認路由

D.對于靜態NAT,實際環境只有當兩條ISP線路都正常時，才會同時能被訪問

E.測試環境，實現靜態NAT當一條線路出現故障時，還能同時被訪問，實現的方法是：

---ASA兩個外部接口配置兩條靜態NAT

---ASA兩個相連的ISP路由器把另外一家ISP所NAT的網段發布出去，并將metric設置比OSPF默認的大

三.測試拓撲：

四.基本配置：
A.R1：
①接口配置：
interface Loopback0
ip address 1.1.1.1 255.255.255.0
interface Loopback61
ip address 61.1.3.1 255.255.255.0
ip ospf network point-to-point
interface Loopback202
ip address 202.100.3.1 255.255.255.0
ip ospf network point-to-point
interface FastEthernet0/0
ip address 202.100.2.1 255.255.255.0
no shut
interface FastEthernet0/1
ip address 61.1.2.1 255.255.255.0
no shut
②路由配置:
router ospf 1
router-id 1.1.1.1
passive-interface default
no passive-interface FastEthernet0/0
no passive-interface FastEthernet0/1
network 61.1.2.1 0.0.0.0 area 0
network 61.1.3.1 0.0.0.0 area 0
network 202.100.2.1 0.0.0.0 area 0
network 202.100.3.1 0.0.0.0 area 0
B:R2：
①接口配置：
interface Loopback0
ip address 2.2.2.2 255.255.255.0
interface FastEthernet0/0
ip address 202.100.1.2 255.255.255.0
no shut
interface FastEthernet0/1
ip address 202.100.2.2 255.255.255.0
no shut
interface FastEthernet1/0
ip address 23.1.1.1 255.255.255.252
no shut
②路由配置：
router ospf 1
router-id 2.2.2.2
log-adjacency-changes
passive-interface default
no passive-interface FastEthernet0/1
no passive-interface FastEthernet1/0
network 23.1.1.1 0.0.0.0 area 0
network 202.100.1.2 0.0.0.0 area 0
network 202.100.2.2 0.0.0.0 area 0
C.R3:
①接口配置：
interface Loopback0
ip address 3.3.3.3 255.255.255.0
interface FastEthernet0/0
ip address 61.1.1.3 255.255.255.0
no shut
interface FastEthernet0/1
ip address 61.1.2.3 255.255.255.0
no shut
interface FastEthernet1/0
ip address 23.1.1.2 255.255.255.252
no shut
②路由配置：
router ospf 1
router-id 3.3.3.3
passive-interface default
no passive-interface FastEthernet0/1
no passive-interface FastEthernet1/0
network 23.1.1.2 0.0.0.0 area 0
network 61.1.1.3 0.0.0.0 area 0
network 61.1.2.3 0.0.0.0 area 0
D.ASA842:
①接口配置：
interface GigabitEthernet0
nameif Inside
security-level 100
ip address 10.1.1.10 255.255.255.0
no shut
interface GigabitEthernet1
nameif Outside
security-level 0
ip address 202.100.1.10 255.255.255.0
no shut
interface GigabitEthernet2
nameif Backup
security-level 0
ip address 61.1.1.10 255.255.255.0
no shut
②兩條線路的動態PAT配置：
object network inside_net
subnet 0.0.0.0 0.0.0.0
object network inside_any
subnet 0.0.0.0 0.0.0.0
object network inside_net
nat (Inside,Outside) dynamic interface
object network inside_any
nat (Inside,Backup) dynamic interface
③兩條線路的靜態NAT配置：
object network Inside_host_outside
host 10.1.1.4
object network Inside_host_backup
host 10.1.1.4
object network Outside-to-backup
host 10.1.1.4
object network Backup-to-outside
host 10.1.1.4
object network Inside_host_outside
nat (Inside,Outside) static 202.100.1.4
object network Inside_host_backup
nat (Inside,Backup) static 61.1.1.4
object network Outside-to-backup
nat (Inside,Outside) static 61.1.1.4
object network Backup-to-outside
nat (Inside,Backup) static 202.100.1.4
----每條線路配置兩條NAT,保證一條ISP線路出現故障時，兩條靜態NAT都能被訪問
④防火墻策略配置：

class-map ALL_IP
match any
policy-map global_policy
class inspection_default
inspect icmp
class ALL_IP
set connection decrement-ttl
service-policy global_policy global
access-list outside extended permit icmp any any
access-list outside extended permit udp any any range 33434 33523
access-list outside extended permit tcp any object Inside_host_outside eq telnet
access-group outside in interface Outside
access-group outside in interface Backup

E:R4:
①接口配置：
interface Loopback0
ip address 192.168.1.4 255.255.255.0
interface FastEthernet0/0
ip address 10.1.1.4 255.255.255.0
no shut
②路由配置：
ip route 0.0.0.0 0.0.0.0 10.1.1.10
③telnet配置：
line vty 0 4
password cisco
login
五.ASA842 SLA及路由配置：
①sla配置：
sla monitor 1
type echo protocol ipIcmpEcho 202.100.1.2 interface Outside
frequency 10
sla monitor schedule 1 life forever start-time now
sla monitor 2
type echo protocol ipIcmpEcho 61.1.1.3 interface Backup
frequency 10
sla monitor schedule 2 life forever start-time now
②track配置：
track 1 rtr 1 reachability
track 2 rtr 2 reachability
③靜態路由配置：
route outside 0 0 202.100.1.2 1 track 1
route backup 0 0 61.1.1.3 254
---默認路由走電信線路，當電信線路出現故障時自動切換到網通線路
route Backup 61.1.2.0 255.255.255.0 61.1.1.3 1 track 2
route Backup 61.1.3.0 255.255.255.0 61.1.1.3 1 track 2
---當網通線路正常時，到網通的網絡的數據走網通的線路，否則走電信的默認路由
route Inside 192.168.1.0 255.255.255.0 10.1.1.4 1
---增加一條回指路由
六.關于靜態NAT：
---為了使兩條線路其中一條線路出現故障時，兩個被靜態NAT地址都能訪問，需要：
A.每條線路配置兩條靜態NAT
----前面已經配置
B.每個相連的ISP路由器把另外一家ISP所NAT的網段發布出去，并將metric設置比ospf默認的大
----這種情況在實際環境基本無法實現，兩家ISP不可能會幫客戶做這樣的事情，除非給的費用足夠多
----測試環境下還是可以玩一玩的
①R2路由器：
ip route 61.1.1.0 255.255.255.0 202.100.1.10 254 tag 10
route-map ASA842 permit 10
match tag 10
router ospf 1
redistribute static metric 130 subnets route-map ASA842
②R3路由器：
ip route 202.100.1.0 255.255.255.0 61.1.1.10 254 tag 10
route-map ASA842 permit 10
match tag 10
router ospf 1
redistribute static metric 130 subnets route-map ASA842

七.效果測試：

A.線路正常的情況下：

R4#traceroute 202.100.3.1 source l0
Type escape sequence to abort.
Tracing the route to 202.100.3.1
1 202.100.1.2 160 msec 108 msec 56 msec
2 202.100.2.1 36 msec * 24 msec
R4#traceroute 61.1.3.1 source l0
Type escape sequence to abort.
Tracing the route to 61.1.3.1
1 61.1.1.3 112 msec 8 msec 0 msec
2 61.1.2.1 112 msec * 68 msec
---去電信的流量走電信，去網通的流量走網通

R1#traceroute 202.100.1.4 source l202
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 202.100.2.2 32 msec 56 msec 20 msec
2 202.100.1.10 40 msec * 24 msec
3 202.100.1.4 80 msec * 16 msec
R1#traceroute 202.100.1.4 source l61
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 202.100.2.2 140 msec 180 msec 80 msec
2 202.100.1.10 64 msec * 88 msec
3 202.100.1.4 140 msec * 84 msec
R1#traceroute 61.1.1.4 source l61
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 61.1.2.3 116 msec 32 msec 0 msec
2 61.1.1.10 4 msec * 4 msec
3 61.1.1.4 208 msec * 128 msec
R1#traceroute 61.1.1.4 source l202
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 61.1.2.3 8 msec 120 msec 192 msec
2 61.1.1.10 0 msec * 20 msec
3 61.1.1.4 152 msec * 204 msec
----兩個被靜態NAT地址都能被訪問，并且電信的地址走電信接口，網通的地址走網通的接口

B.電信線路不正常的情況下：

R4#traceroute 202.100.3.1 source l0
Type escape sequence to abort.
Tracing the route to 202.100.3.1
1 10.1.1.10 188 msec * 28 msec
2 61.1.1.3 44 msec 0 msec 0 msec
3 61.1.2.1 108 msec * 84 msec
R4#traceroute 61.1.3.1 source l0
Type escape sequence to abort.
Tracing the route to 61.1.3.1
1 10.1.1.10 0 msec * 20 msec
2 61.1.1.3 100 msec 32 msec 0 msec
3 61.1.2.1 108 msec * 72 msec
---去電信和網通的流量都走網通
R1#traceroute 202.100.1.4 source l202
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 61.1.2.3 4 msec 184 msec 52 msec
2 61.1.1.10 0 msec * 0 msec
3 202.100.1.4 152 msec * 12 msec
R1#traceroute 202.100.1.4 source l61
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 61.1.2.3 36 msec 4 msec 16 msec
2 61.1.1.10 200 msec * 16 msec
3 202.100.1.4 184 msec * 148 msec
R1#traceroute 61.1.1.4 source l61
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 61.1.2.3 48 msec 0 msec 0 msec
2 61.1.1.10 4 msec * 32 msec
3 61.1.1.4 148 msec * 180 msec
R1#traceroute 61.1.1.4 source l202
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 61.1.2.3 76 msec 52 msec 0 msec
2 61.1.1.10 0 msec * 16 msec
3 61.1.1.4 172 msec * 112 msec
----電信和網通被靜態NAT的地址都能被電信和網通的用戶訪問

C.網通線路不正常的情況下：

R4#traceroute 202.100.3.1 source l0
Type escape sequence to abort.
Tracing the route to 202.100.3.1
1 10.1.1.10 8 msec * 28 msec
2 202.100.1.2 108 msec 72 msec 84 msec
3 202.100.2.1 88 msec * 128 msec
R4#traceroute 61.1.3.1 source l0
Type escape sequence to abort.
Tracing the route to 61.1.3.1
1 10.1.1.10 0 msec * 76 msec
2 202.100.1.2 112 msec 96 msec 24 msec
3 202.100.2.1 248 msec * 76 msec
---去電信和網通的流量都走電信
R1#traceroute 202.100.1.4 source l202
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 202.100.2.2 4 msec 156 msec 76 msec
2 *
202.100.1.10 40 msec *
3 202.100.1.4 68 msec * 24 msec
R1#traceroute 202.100.1.4 source l61
Type escape sequence to abort.
Tracing the route to 202.100.1.4
1 202.100.2.2 92 msec 60 msec 124 msec
2 202.100.1.10 4 msec * 36 msec
3 202.100.1.4 152 msec * 60 msec
R1#traceroute 61.1.1.4 source l61
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 202.100.2.2 32 msec 136 msec 116 msec
2 202.100.1.10 80 msec * 56 msec
3 61.1.1.4 120 msec * 120 msec
R1#traceroute 61.1.1.4 source l202
Type escape sequence to abort.
Tracing the route to 61.1.1.4
1 202.100.2.2 4 msec 140 msec 112 msec
2 202.100.1.10 64 msec * 64 msec
3 61.1.1.4 156 msec * 80 msec
----電信和網通被靜態NAT的地址都能被電信和網通的用戶訪問