网络工程 - 等待中的 Cisco 故障切换接口 - 吾爱随笔录

我有以下场景，我从 ISP 获得 1G 铜质 Cat6 电缆并直接终止在我的 Cisco ASA 防火墙Gi0/8接口上，我现在配置failover了故障转移输出，它正在监控状态，(waiting)因为它们来自不同的 ISP 路由器，怎么办我在不引入L2ISP 和我的 ASA 之间的任何切换的情况下解决了这个问题？

我确信我无法 pingASA-2公共 IP 的外部接口，ASA-1因为我看到状态正在等待，但还有其他解决方法吗？我在 ASA 上确实有许多免费的 1G 接口，我可以创建特殊的 VLAN 并在它们之间路由流量吗？

asa-1/sec/act# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: FailoverLink Redundant1 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 200 milliseconds, holdtime 800 milliseconds
Interface Poll frequency 500 milliseconds, holdtime 5 seconds
Interface Policy 1
Monitored Interfaces 3 of 1049 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.6(3)1, Mate 9.6(3)1
Serial Number: Ours AAAAAA, Mate BBBBBB
Last Failover at: 00:41:50 UTC Mar 9 2018
    This host: Secondary - Active
        Active time: 504599 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (2.0/9.6(3)1) status (Up Sys)
          Interface management (10.x.x.118): Normal (Monitored)
          Interface outside (74.xx.xx.110): Normal (Waiting)
          Interface inside (74.xx.xx.10): Normal (Monitored)
        slot 1: empty
    Other host: Primary - Failed
        Active time: 12 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (1.3/9.6(3)1) status (Up Sys)
          Interface management (10.x.x.119): Normal (Monitored)
          Interface outside (74.xx.xx.109): Failed (Waiting)
          Interface inside (74.xx.xx.11): Normal (Monitored)
                slot 1: empty

ASA-2

asa-2/pri/stby# show failover
Failover On
Failover unit Primary
Failover LAN Interface: FailoverLink Redundant1 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 200 milliseconds, holdtime 800 milliseconds
Interface Poll frequency 500 milliseconds, holdtime 5 seconds
Interface Policy 1
Monitored Interfaces 3 of 1049 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.6(3)1, Mate 9.6(3)1
Serial Number: Ours BBBBBB, Mate AAAAA
Last Failover at: 00:42:40 UTC Mar 9 2018
    This host: Primary - Standby Ready
        Active time: 12 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (1.3/9.6(3)1) status (Up Sys)
          Interface management (10.x.x.119): Normal (Monitored)
          Interface outside (74.xx.xx.109): Normal (Waiting)
          Interface inside (74.xx.xx.11): Normal (Monitored)
        slot 1: empty
    Other host: Secondary - Active
        Active time: 506081 (sec)
        slot 0: ASA5585-SSP-20 hw/sw rev (2.0/9.6(3)1) status (Up Sys)
          Interface management (10.x.x.118): Normal (Monitored)
          Interface outside (74.xx.xx.110): Normal (Waiting)
          Interface inside (74.xx.xx.10): Normal (Monitored)
                slot 1: empty

接口配置：

首先，我配置了故障转移，然后在这种情况下运行此命令，它将在备用 ASA-2 上设置 .109 ip，对吗？

!
interface GigabitEthernet0/0
 description 1G_HANDOFF
 nameif outside
 security-level 0
 ip address 74.xx.xx.110 255.255.255.248 standby 74.xx.xx.109
!

故障转移配置：

asa-1/sec/act# sh run failover
failover
failover lan unit primary
failover lan interface FailoverLink Redundant1
failover polltime unit msec 200 holdtime msec 800
failover polltime interface msec 500 holdtime 5
failover link FailoverLink Redundant1
failover interface ip FailoverLink 192.168.100.1 255.255.255.0 standby 192.168.100.2