Dual active/passive failover of ISP with static Nat on Cisco 1941

Similar Questions

• IPS modules in the ASA config for active/passive failover

  Hey guys,.

  We have two ASA in a situation of active/passive failover each with a module AIP-SSM-20 IPS.

  These modules are intended to synchronize their configs like the ASA do? Alternatively, they each have a separate entity and each need to be configured separately?

  Thanks for any help!

  Each will have their own IP address, and each must be configured separately.

  They will not communicate with each other and share no configuration.

  You will need to make sure the config is changed in one of the other.

  Monitoring station pull events from two sensors.

  The SSMs rely on the SAA for the TCP state tracking so they will work very well in a design of failover ASA.

• Communicator TCP active & passive can not communicate with graphic

  Hello

  I send and receive TCP Communicator Active & Passive data.

  I have change and can now show data(given fixed) and graphic.

  My Active part can work. But I can't send liabilities...

  confused ha... hahahs.

  
  

• VPN with static nat for a whole subnet

  Hey there,

  For some reason, I can't do this on the router. Errrr...

  I'm trying to config a static nat (many to one), which will be in effect only when traffic needs to go on our vpn tunnel to the remote location.

  example:

  internal LAN 192.168.0.0

  remote network: 10.10.10.0 and 10.10.15.0

  When traffic passes over the tunnel vpn - at the remote site, I need to translate my internal network (192.168.0.0) to an ip address 172.16.32.65 static

  any ideas?

  also on my crypto map ACL, which must be specified for interesting traffic? my local network or static ip address search?

  Let me know your thoughts on the matter.

  Kind regards

  R.

  NAT you describe is named PAT or overload, at least in terms of Ciscos...

  What you need:

  (1) a NAT - ACL when you describe your traffic which should be natted.

  (2) a nat pool with your 172.16.32.65 address

  (3) a statement-NAT for dynamic NAT inside based on the ACL for the pool

  Here are some examples:

  http://www.Cisco.com/en/us/docs/iOS/ipaddr/configuration/guide/iadnat_addr_consv_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1073436

  Your crypto ACL then referred to the NATted IP as NAT happens before encryption.

• Static NAT problem with PIX501

  Hi all

  We have problems with our PIX firewall. We have configured PIX 501 with static NAT for our Web server. Here's the running configuration.

  6.3 (4) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  pixfirewall hostname

  domain ciscopix.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit tcp any host x.x.x.26 eq www

  access-list 101 permit tcp any host x.x.x.26 EQ field

  access-list 101 permit udp any host x.x.x.26 EQ field

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside x.x.x.28 255.255.255.248

  IP address inside 192.168.90.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.90.0 255.255.255.0 inside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) x.x.x.26 192.168.90.3 netmask 255.255.255.255 0 0

  Access-group 101 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.25 1

  Route inside 192.168.1.0 255.255.255.0 192.168.90.2 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.90.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  Terminal width 80

  : end

  the problem is the configuration, we are unable to access the web server both inside and outside the network.

  All input will be greatly appreciated.

  Kind regards

  udimpas

  activate icmp backtrace and then ping the x.x.x.26 of the internet. the output should be as below:

  3363574:-out ICMP echo request: ID = 21834 seq = 1202 length = 80

  3363575: ICMP echo request: external untranslating: inside: 192.168.90.3

  3363576: ICMP echo-reply from the inside: 192.168.90.3 ID = 21834 seq = 1202 length = 80

  3363577: response to ICMP echo -: translate inside: 192.168.90.3 out:

  by doing this, you can 1. Check the nat 2. If the server responds to the internet.

  do not forget to allow incoming icmp:

  access-l 101 permit icmp any one

• PIX 501 PPPoE w / static NAT loss of connectivity

  I have a {should} installation very simple. PIX 501 with PPPoE on the external interface, 3 inside customers using PAT and 1 inside the client I am trying to use an address mapping static on permit communications with this host from the outside using a particular service. I did a lot of these before where there was an ADSL router in front of the PIX, but this is the first where I've used the PIX as the PPPoE client. When I use the static NAT for the single host it loses all connectivity beyond the PIX outside interface. When I get rid of the static mapping, through PAT very well. I spent many hours troubleshooting and control a lot of obvious things, but I am at a loss right now... unless it could be a problem with the IP address that has been assigned by the ISP for use with static NAT. Any thoughts on this would be greatly appreciated.

  Thank you

  Sorry, in your case that static would look like this because of the dynamic IP.

  static (inside, outside) 23 interface 10.1.1.1 23 netmask 255.255.255.255

  Daniel

• Static NAT & DMVPN Hub

  Hello

  I don't think that will be a problem DMVPN supports the rays behind NAT devices, but I anticipate change my network for reasons of security and redudancy autour and putting a pair of ASA firewalls on my Internet collocation.  Right now I have a DMVPN race 3845, NAT & ZBFW.  I'm going to remove the ZBFW and move the NAT to the ASA, leaving only the DMVPN hub and routing.  If I create a static NAT mapping on my ASA to point to the DMVPN hub that will work?

  I think it will be, but I just wanted to be 110% sure.

  Thank you!

  Hi Brantley,

  DMVPN with static NAT on the hub is supported in the installer. Just be awear it there are limits.

  1, all DMVPN router, hub and spokes must be running at least 12.3(9a) and 12.3 (11) T code.

  2, must use ipsec transport mode.

  3, so need dynamic tunnel talk to rays, hub should work at least 12.3 (13), 12.3 (14) T and 12.3 (11) T3 code.

  See the configuration guide

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_DMVPN_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1122466

  HTH,

  Lei Tian

• Active/passive HA comments with shared vmdk

  I have 2 ESXi host with a vmfs on iSCSI SAN.

  I want to install 2 identical VM on each host suite HR cluster in active/passive mode.

  I intend to set up the two VM with a disc 'private' for the base OS/APP installation and a 'common' one disk for data

  managed by the services that are configured in active/passive mode (for example, MySQL, OpenLDAP).

  The goal is that when the master virtual machine fails (because of true judgment of breach or ESXi host simpleVM), the slave VM built the commune

  VMDK and starts the cluster services.

  I've read a few articles on the possibility of sharing a vmdk disk so the solution seems possible.

  Is there someone who has used such a configuration?

  TIA,

  Guido

  An alternative is to create a network of VM for iSCSI (depending on your SAN topology, you must also 2 storage networks).

  Then, you can add this network to the virtual computer, install the initiator software and set it up as a physical machine.

  André

  * If you found this device or any other answer useful please consider awarding points for correct or helpful answers

• Active-passive HA topology

  Hi all
  
  I found this doc 10g for topology active-passive configuration.
  

  Environments, active and Passive, also known as the cold Failover Cluster (CFC) environments. http://docs.Oracle.com/CD/B16240_01/doc/install.102/e10953/actpass_env.htm

  http://docs.Oracle.com/CD/B31019_01/install.1013/install/ha.htm#BABEAAAD

  is still available in 11 g? or phased out?
  
  He mentions by name 2 types of configuration:
  
  1 figure 6-3 active-passive topology with Oracle HTTP Server and OC4J under the same roof of Oracle
  2 figure 6-4 active-passive topology with Oracle HTTP Server and OC4J Separate Oracle home
  
  Who, if the two types is easier to install and more reliable?
  
  Note also the computer use "vendor clusterware", I can use "Oracle clusterware" instead?
  
  Thank you very much
  
  zxy

  If your situation is unique, realistically, this means that you will have to do a lot of work on the ground. You have to read the documentation. You're going to have to understand all the options available, not just look at the "quick start" guide You have to develop the scripts you need for your specific environment.

  Honestly, I'm miles to figure out exactly what you're trying to build. I see that you seem to try to combine a Frankenstein monster using a variety of different technologies, but the high-level architecture escapes me. Now, there may be good reasons for this. You tell us to accept this fact, so I did. But once you decide we have to accept that you do something quite unique with an architecture that nobody has ever tried it before, you must agree that you should give up the desire to rely on quick start guides and people you will find in the forums to help out you. You build something quite unique. You need scripts, totally unique. You need to read a ton of documentation to know how to get all the disparate elements together. You will need to experiment.

  Think of it as buying a car. If you want to buy a standard vehicle type, others can help you choose some standard templates to use. If you want to carry things, people can help you choose a suitable truck. If you have a bunch of kids, people can help you to choose a proper van. If you choose a standard architecture, we can probably help you to implement.

  If, however, you decide that you want to build a vehicle fully custom from the ground because you decide that your needs are sufficiently unique to justify this, then you will have to solve problems much more. If you want to try to combine the engine of a Ford pickup with the exhaust of a Toyota sedan and add a block custom and make cooking oil engine, you will encounter a number of problems that no one else has met him. This means that you will have to do a lot of steps to work through these problems. Similarly, if you need a unique hybrid technology, we cannot reasonably is toward literature and wish you good luck because you will have to do a lot of reading and experimenting to get something like this to work.

  It seems that you hope you can build something unique without doing more work than if you were going to build something completely standard. You agree that this is not possible. If you want to implement something quite unique, you have to make yourself an expert in the inner workings of a bunch of different technologies.

  Justin

• I can't add/subnet mask 31 255.255.255.254 ISP WAN > static IP setting in VPN Firewall SRX5308

  Hello

  I can't add/subnet mask 31 255.255.255.254 ISP WAN > static IP setting in VPN Firewall SRX5308. When I try to apply it, I get the popup error message like "invalid IP subnet mask. Please enter 0/128/192/224/240/248/252 for octet 4 ". I try to add provider NTU fiber optic internet service in one of the 4 WAN settings. The vendor gave me a 31 block IP and the subnet as 255.255.255.254 mask. It is a limitation in this firewall? I have to ask the provider to give me a 30 block the IP instead? With 30 block IP subnet mask will be 255.255.255.252 who is authorized by this firewall setting. I tried this on another (SnapGear SG560) firewall and it works without any problem. See the screenshots below. Can someone please?

  

  

  concerning

  Ridwan

  / 31 would be used in specific scenarios where you * really * need to keep the address space and on links only point to point. To be honest I've never met anyone, or any ISP that uses it. It works on point to point, because, well, there no need to broadcast address because there are only two devices on the link (one on each side of the cable)... IP address ranges would be;. 0-. 1,.2-. 3, etc.

  Most (if not all) Netgear devices will prevent you from setting 31, but you will probably be able to use without problem in all 30 cases, according to the setup of the ISP I do not think that it would cause you problems really. But if you can, I would certainly ask a 30 instead.

• Cisco ASA5520 facing ISP with private IP address. How to get the IPSec VPN through the internet?

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-marge-top : 0 ; mso-para-marge-droit : 0 ; mso-para-marge-bas : 10.0pt ; mso-para-marge-left : 0 ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ;}

  Hello guys,.

  I have Cisco ASA5520 facing the ISP with private IP address. We don't have a router and how to get the IPSec VPN through the internet?

  The question statement not the interface pointing to ISP isn't IP address private and inside as well.

  Firewall configuration:

  Firewall outside interface Gi0 10.0.1.2 > ISP 10.0.1.1 with security-level 0

  Firewall inside the interface Ethernet0 192.168.1.1 > LAN switch 192.168.1.2 with security-level 100

  I have public IP block 199.9.9.1/28

  How can I use the public IP address to create the IPSec VPN tunnel between two sites across the internet?

  can I assign a public IP address on the Gig1 inside the interface with the security level of 100 and how to apply inside to carry on this interface?

  If I configure > firewall inside of the item in gi1 interface ip address 199.9.9.1/28 with security-level 100. How to make a safe lane VPN through this interface on the internet?

  I'm used to the public IP address allocation to the interface outside of the firewall and private inside the interface IP address.

  Please help with configuration examples and advise.

  Thank you

  Eric

  Unfortunately, you can only complete the VPN connection on the interface the VPN connection source, in your case the external interface.

  3 options:

  (1) connect a router in front of the ASA and assign your public ip address to the ASA outside interface.

  OR /.

  (2) If your ISP can perform static translation of 1 to 1, then you can always finish the VPN on the external interface and ask your provider what is the static ip address assigned to your ASA out of the IP (10.0.1.2) - this will launch the VPN of bidirectionally

  OR /.

  (3) If your ISP performs PAT (dynamic NAT), then you can only start the tunnel VPN on the side of the ASA and the other end of the tunnel must be configured to allow VPN LAN-to-LAN dynamics.

• VPN works in Active Active Firewall failover mode?

  I want to clarify these two things!
  1. what VPN works in active/active mode failover mode?

  2. what failover active/Pasive mode?

  Kind regards!

  Hello

  With the help of an active/active failover means that firewalls will be in Multiple context mode. In other words the virtual firewall.

  This means that you can ONLY use the L2L IPsec VPN connections on the virtual firewall if you run level software on the firewall 9.x. Any form of Client and clientless VPN is not supported in multiple context Mode right now.

  Now with active / standby, it must make a distinction (if that is the word).

  IF you run a pair of active failover / normal standby time of ASAs IS NOT in Multiple context mode, YOU CAN use any type of VPN support ASAs.

  IF you run a pair of ASAs in several Mode of context and active / standby, you will naturally meet the limitation of VPN in Multiple Mode of context support and do WILL NOT be able to use any other VPN other than IPsec VPN L2L connections as long as you run the 9.x software that supports.

  Hope this helps

  -Jouni

• In Active/Passive Mode Radius server configuration

  We set up (active/active) the two ASA load balancing.  We also configure two Radius servers with load balancing.  At present, the Radius servers are configured with active/active.  Is it possible to configure a Radius Server with (active/passive)?

  RADIUS protocol Radius AAA server
  AAA-server Radius (inside) host XXX.XXX.XXX.XXX
  Timeout 300
  key *.
  RADIUS-common-pw *.

  AAA-server Radius (inside) host XXX.XXX.XXX.XXX
  Timeout 300
  key *.
  RADIUS-common-pw *.

  AAA accounting enable console RADIUS

  Thank you.

  Diane

  Diane,

  Well I'm still not 100% sure that you understand exactly what is happening. Normally, on a single ASA, authentication is always performed on the same radius server until it fails (i.e. active/passive as you call it).

  Now, you mention that you have 2 ASAs in load balancing, so I don't know if you mean that:

  (1) 2 users that connect to the same ASA get authenticated by radius 2 servers different (should never happen)

  or

  (2) when 2 users connect to the cluster, user1 gets redirected to ASA1 and authenticated on Radius1, while User2 will be redirected to ASA2 using Radius2 to auth. This could be normal if both ASAs are set up differently (defined in a different order radius servers) or an ASA had a problem connecting to Radius1, at some point and so it considered out of service.

  In any case, 'sh aaa-server protocol radius' and 'debug RADIUS' can help determine why an asa individual does not use (initially configured) primary radius server.

  HTH

  Herbert

• licenses for a cisco ASA active/passive pair AnyConnect SSL

  Hi all. I buy 2 5512 x ASAs is configured like a pair of active/passive as a VPN device. I need to purchase licenses for both devices anyconnect? Thank you

  Licenses AnyConnect Essentials (or premium) are combined on a cluster failover ASA. Reference

  So, buy once only the quantity and type of licenses you need based on your end users - not based on the number of ASAs - and they will be available at the ASA Active whether primary or secondary unit.

• Is it possible to install oracle fail-safe-kind-of (active-passive) SAN replication for oracle?

  Dear Experts,

  Is it possible to configure replication of SAN (active-passive) integrated security for oracle for oracle?

  To get the RTO < 60 seconds

  • If the primary host fails, the remote site should have the option to start the oracle database.
  • Sites are geographically remote.

  SAN storage replication, can it be used in my scenario?

  • I have no option to implement oracle Data Guard as its very expensive.

  Is that what someone achieved something similar with SAN storage replication?

  • I have oracle SE.
  • It is obvious that the all-flash backup can be quick.

  What should be the strategy to have DR site get a few seconds, if the primary site failed for some reason any

  • Daily incremental backup with RMAN. And archive backup runs for every 1 minutes
  • To have the site of DR upward and running within 60 seconds, it still requires too much time to restore the database on remote site and have archive APPLIED setpoint
  • What could be the solution with san replication? RTO is 60 seconds

  Thanks and greetings

  SAN storage replication, can it be used in my scenario?

  I have no option to implement oracle Data Guard as its very expensive.

  --> If you want to use the data that it is free of CHARGE, additional license is not required for normal data guard

  --> additional license is only for the ADG

  Is that what someone achieved something similar with SAN storage replication?

  I have oracle SE.

  It is obvious that the all-flash backup can be quick.

  --> Here, I understand that if oraclle EA is going to be expensive

  --> Again, you can use manual standby

  --> What you are looking for SAN replication, you will need to check with the storage vendor

  --> If your intention is to check with oracle storage, then this may be the correct discussion room

  What should be the strategy to have DR site get a few seconds, if the primary site failed for some reason any

  Daily incremental backup with RMAN. And archive backup runs for every 1 minutes

  To have the site of DR upward and running within 60 seconds, it still requires too much time to restore the database on remote site and have archive APPLIED setpoint

  What could be the solution with san replication? RTO is 60 seconds

  --> If your intention is to check with oracle storage, then this may be the correct discussion room

  Check in this

  https://community.Oracle.com/community/Server_%26_storage_systems/storage