اختبار Cisco CCIE Security v6.0 LAB

Task 1.1a : configure ASA1_V and ASA11_V For Active-Standby Failover

Your configuration should meet the following requirements_ 

ASA1_V 

Interface Gi0/0 : 

Address Primary-Standby: 20.1.1.1/24-20.1.1.2/24 

Name: outside Interface Gi0/1: 

Address Primary-Standby: 10.1.11.1/24-10.1.11.2/24 

Name: inside 

Interface Management 0/0: 

Address Primary-Standby: 150.1.7.53/24-150.1.7.54/24 

Name: mgmt 

Security level : 100

Failover : 

Unit primary 

Lan-link interface: Gi0/2 

Primary-standby：10.10.11.1/24-10.10.11.2/24 

Name: FO 

EIGRP Routing : 

Autonomous system： 12 

Network:10.1.11.0/24 

EIGRP Authentication : 

Mode MD5 

Key-ID : 1 

Password：cisco 

ASA11_V 

Failover： 

Unit secondary 

Lan-link interface Gi0/2 

Primary-Standby : 10.10.11.1/24-10.10.11.2/24 

Name : FO 

Note： 

Make sure that all the interface are being monitored for this failover implementation。 

Points：2 

Solution 

================================================================= 

ASA1v/ASA11v: 

ASA1v(config)# show firewall 

Firewall mode: Router ----------correct mode 

Or 

ASA1v(config)# no firewall transparent 

ASA1v(config)# show firewall 

Firewall mode: Router 

================================================================= 

Failover 

================================================================= 

ASA1v/ASA11v: 

interface GigabitEthernet0/2 

no shutdown 

---------------------------------------------------------------------------------------------------------------------- 

ASA1_V： 

failover lan unit primary 

failover lan interface FO GigabitEthernet0/2 

failover link FO GigabitEthernet0/2 

failover interface ip FO 10.10.11.1 255.255.255.0 standby 10.10.11.2 

--------------------------------------------------------------------------------------------------------------------- 

ASA11_V：

failover lan unit secondary 

failover lan interface FO GigabitEthernet0/2 

failover link FO GigabitEthernet0/2 

failover interface ip FO 10.10.11.1 255.255.255.0 standby 10.10.11.2 

--------------------------------------------------------------------------------------------------------------------- 

ASA1v: ASA1V(config)#ping 10.10.11.2 ASA1V(config)# failover ASA11v: ASA11V(config)# failover 

=================================================================== 

Verify 

=================================================================== 

ASA1V: ASA11V: =================================================================== 

ASA1v: Primary/Active 

=================================================================== 

interface GigabitEthernet0/0 

no shutdown 

nameif outside 

security-level 0 

ip address 20.1.1.1 255.255.255.0 standby 20.1.1.2 

exit 

interface GigabitEthernet0/1 

no shutdown 

nameif inside 

security-level 100 

ip address 10.1.11.1 255.255.255.0 standby 10.1.11.2 

authentication key eigrp 12 cisco key-id 1 

authentication mode eigrp 12 md5 

exit 

interface Management0/0 

no shutdown 

nameif mgmt 

security-level 100 

ip address 150.1.7.53 255.255.255.0 standby 150.1.7.54 

exit 

ASA1V(config)#ping 20.1.1.10 

ASA1V(config)#ping 10.1.11.10 

ASA1V(config)#ping 150.1.7.201 router eigrp 12 

network 10.1.11.0 255.255.255.0 

================================================================== 

Verify 

==================================================================

ASA1v:

Task 1.1b : configure ASA2_V and ASA22_V For Active-Standby Failover

Task 1.2 : configure ASA1 and ASA2 For the Active-Active Failover

Task 1.3 : configure ASA3 and ASA4 for Clustering

Task 1.4 : configure Access Policy On NGIPS

Your configuration should meet the following requirements_

Rule 1: Permit EIGRP routing process between R1 and R2. R1 Should be in the external Zone. R2 Should be in the internal Zone. Enable Logging for the rules at the beginning of the connection. 

Solution 

*****************************************************************************************************

Tips:

1、Sometimes should reconfigure Objects and Rules 

2、NGIPS has registered to FMC in the exam 

***************************************************************************************************** =================================================================== 

Permit EIGRP traffic 

=================================================================== 

Just confirm eth1-external zone , eth2-internal zone =================================================================== 

Check the preconfig of Objects

=================================================================== 

Add Rule 1 

===================================================================