此产品的文档集力求使用非歧视性语言。在本文档集中,非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言,文档中可能无法确保完全使用非歧视性语言。 深入了解思科如何使用包容性语言。
思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言,希望全球的用户都能通过各自的语言得到支持性的内容。 请注意:即使是最好的机器翻译,其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任,并建议您总是参考英文原始文档(已提供链接)。
本文档介绍Firepower威胁防御(FTD)设备上的内联对接口的配置、验证和操作。
本文档没有特定要求。
本文档中的信息基于以下软件和硬件版本:
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
本文档也可用于以下硬件和软件版本:
FTD 是由两个主要引擎组成的统一软件映像:
下图显示了这两个引擎的交互方式:
FTD提供两种部署模式和六种接口模式,如图所示:
注意:您可以在单个FTD设备上混合接口模式。
以下是各种FTD部署和接口模式的简要概述:
FTD接口模式 |
FTD部署模式 |
描述 |
可以丢弃流量 |
已路由 |
已路由 |
完整的LINA引擎和Snort引擎检查 |
Yes |
交换 |
透明 |
完整的LINA引擎和Snort引擎检查 |
Yes |
内联对 |
路由或透明 |
部分LINA引擎和完全Snort引擎检查 |
Yes |
带分路器的内联对 |
路由或透明 |
部分LINA引擎和完全Snort引擎检查 |
无 |
被动 |
路由或透明 |
部分LINA引擎和完全Snort引擎检查 |
无 |
被动(ERSPAN) |
已路由 |
部分LINA引擎和完全Snort引擎检查 |
无 |
要求
按照以下要求在内联对模式下配置物理接口e1/6和e1/8:
接口 | e1/6 | e1/8 |
名称 | 内部 | 外部 |
安全区域 | INSIDE_ZONE | OUTSIDE_ZONE |
内联集名称 | 内联对1 | |
内联集MTU | 1500 | |
FailSafe | 启用 | |
传播链路状态 | 启用 |
解决方案
步骤1:要配置各个接口,请导航到Devices > Device Management,选择适当的设备并选择Edit,如图所示。
接下来,为接口指定Name和Tick Enabled,如图所示。
注:Name是接口的名称。
对于接口Ethernet1/8也是类似的。最终结果如图所示。
第二步:配置内联对。
导航到内联集>添加内联集,如图所示。
第三步:按照图中所示的要求配置General设置。
注意:Failsafe允许流量未经检查通过内联对,以防接口缓冲区已满(通常在设备过载或Snort引擎过载时看到)。接口缓冲区大小是动态分配的。
第四步:如图所示,在Advanced Settings中启用Propagate Link State选项。
当内联集中的一个接口关闭时,链路状态传播会自动关闭内联接口对中的第二个接口。
第五步:保存更改并部署。
使用本部分可确认配置能否正常运行。
从FTD CLI验证内联对配置。
解决方案
登录到FTD CLI并验证内联对配置:
> show inline-set
Inline-set Inline-Pair-1
Mtu is 1500 bytes
Failsafe mode is on/activated
Failsecure mode is off
Tap mode is off
Propagate-link-state option is on
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/6 "INSIDE"
Current-Status: UP
Interface: Ethernet1/8 "OUTSIDE"
Current-Status: UP
Bridge Group ID: 509
>
注:网桥组ID是一个不同于0的值。如果“分路模式”打开,则值为0
接口和名称信息:
> show nameif
Interface Name Security
Ethernet1/6 INSIDE 0
Ethernet1/7 diagnostic 0
Ethernet1/8 OUTSIDE 0
>
检验接口状态:
> show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Internal-Data0/2 169.254.1.1 YES unset up up
Ethernet1/6 unassigned YES unset up up
Ethernet1/7 unassigned YES unset up up
Ethernet1/8 unassigned YES unset up up
检验物理接口信息:
> show interface e1/6
Interface Ethernet1/6 "INSIDE", is up, line protocol is up
Hardware is EtherSVI, BW 1000 Mbps, DLY 1000 usec
MAC address 5897.bdb9.770e, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
IP address unassigned
Traffic Statistics for "INSIDE":
468 packets input, 47627 bytes
12 packets output, 4750 bytes
1 packets dropped
1 minute input rate 0 pkts/sec, 200 bytes/sec
1 minute output rate 0 pkts/sec, 7 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 96 bytes/sec
5 minute output rate 0 pkts/sec, 8 bytes/sec
5 minute drop rate, 0 pkts/sec
> show interface e1/8
Interface Ethernet1/8 "OUTSIDE", is up, line protocol is up
Hardware is EtherSVI, BW 1000 Mbps, DLY 1000 usec
MAC address 5897.bdb9.774d, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
IP address unassigned
Traffic Statistics for "OUTSIDE":
12 packets input, 4486 bytes
470 packets output, 54089 bytes
0 packets dropped
1 minute input rate 0 pkts/sec, 7 bytes/sec
1 minute output rate 0 pkts/sec, 212 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 7 bytes/sec
5 minute output rate 0 pkts/sec, 106 bytes/sec
5 minute drop rate, 0 pkts/sec
>
本节介绍以下验证检查以验证内联对操作:
解决方案
架构概述
当2个FTD接口在内联对模式下运行时,数据包的处理方式如图所示。
注意:只有物理接口才能成为内联对集的成员
最后一点可以可视化,如图所示:
Packet Tracer输出模拟经过内联对的数据包,其中突出显示的重要点:
> packet-tracer input INSIDE tcp 192.168.201.50 1111 192.168.202.50 80
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: NGIPS-MODE
Subtype: ngips-mode
Result: ALLOW
Config:
Additional Information:
The flow ingressed an interface configured for NGIPS mode and NGIPS services is be applied
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced permit ip any any rule-id 268438528
access-list CSM_FW_ACL_ remark rule-id 268438528: ACCESS POLICY: FTD4100 - Default/1
access-list CSM_FW_ACL_ remark rule-id 268438528: L4 RULE: DEFAULT ACTION RULE
Additional Information:
This packet is sent to snort for additional processing where a verdict is reached
Phase: 4
Type: NGIPS-EGRESS-INTERFACE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Ingress interface INSIDE is in NGIPS inline mode.
Egress interface OUTSIDE is determined by inline-set configuration
Phase: 5
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 106, packet dispatched to next module
Result:
input-interface: INSIDE
input-status: up
input-line-status: up
Action: allow
>
您可以使用可设计实用程序(如Scapy)的数据包生成TCP SYN/ACK数据包。此语法生成启用了SYN/ACK标志的3个数据包:
root@KALI:~# scapy INFO: Can't import python gnuplot wrapper . Won't be able to plot. WARNING: No route found for IPv6 destination :: (no default route?) Welcome to Scapy (2.2.0) >>> conf.iface='eth0' >>> packet = IP(dst="192.168.201.60")/TCP(flags="SA",dport=80) >>> syn_ack=[] >>> for i in range(0,3): # Send 3 packets ... syn_ack.extend(packet) ... >>> send(syn_ack)
在FTD CLI上启用此捕获并发送一些TCP SYN/ACK数据包:
> capture CAPI interface INSIDE trace match ip host 192.168.201.60 any
> capture CAPO interface OUTSIDE match ip host 192.168.201.60 any
>
通过FTD发送数据包后,您可以看到已创建的连接:
> show conn detail
1 in use, 34 most used
Flags: A - awaiting responder ACK to SYN, a - awaiting initiator ACK to SYN,
b - TCP state-bypass or nailed,
C - CTIQBE media, c - cluster centralized,
D - DNS, d - dump, E - outside back connection, e - semi-distributed,
F - initiator FIN, f - responder FIN,
G - group, g - MGCP, H - H.323, h - H.225.0, I - initiator data,
i - incomplete, J - GTP, j - GTP data, K - GTP t3-response
k - Skinny media, M - SMTP data, m - SIP media, N - inspected by Snort, n - GUP
O - responder data, P - inside back connection,
q - SQL*Net data, R - initiator acknowledged FIN,
R - UDP SUNRPC, r - responder acknowledged FIN,
T - SIP, t - SIP transient, U - up,
V - VPN orphan, v - M3UA W - WAAS,
w - secondary domain backup,
X - inspected by service module,
x - per session, Y - director stub flow, y - backup stub flow,
Z - Scansafe redirection, z - forwarding stub flow
TCP Inline-Pair-1:OUTSIDE(OUTSIDE): 192.168.201.60/80 Inline-Pair-1:INSIDE(INSIDE): 192.168.201.50/20,
flags b N, idle 13s, uptime 13s, timeout 1h0m, bytes 0
>
注意:b标志 — 传统ASA将丢弃未经请求的SYN/ACK数据包,除非启用TCP状态旁路。内联对模式下的FTD接口在TCP状态旁路模式下处理TCP连接,并且不丢弃不属于现有连接的TCP数据包。
注意:N标志 — 数据包由FTD Snort引擎进行检查。
捕获结果证明了这一点,因为您可以看到流经FTD的3个数据包:
> show capture CAPI
3 packets captured
1: 15:27:54.327146 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
2: 15:27:54.330000 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3: 15:27:54.332517 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3 packets shown
>
3个数据包退出FTD设备:
> show capture CAPO
3 packets captured
1: 15:27:54.327299 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
2: 15:27:54.330030 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3: 15:27:54.332548 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
3 packets shown
>
通过跟踪第一个捕获数据包,可以揭示一些其他信息,如Snort引擎判定:
> show capture CAPI packet-number 1 trace 3 packets captured 1: 15:27:54.327146 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: NGIPS-MODE Subtype: ngips-mode Result: ALLOW Config: Additional Information: The flow ingressed an interface configured for NGIPS mode and NGIPS services is applied Phase: 4 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group CSM_FW_ACL_ global access-list CSM_FW_ACL_ advanced permit ip any any rule-id 268438528 access-list CSM_FW_ACL_ remark rule-id 268438528: ACCESS POLICY: FTD4100 - Default/1 access-list CSM_FW_ACL_ remark rule-id 268438528: L4 RULE: DEFAULT ACTION RULE Additional Information: This packet is sent to snort for additional processing where a verdict is reached Phase: 5 Type: NGIPS-EGRESS-INTERFACE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: Ingress interface INSIDE is in NGIPS inline mode. Egress interface OUTSIDE is determined by inline-set configuration Phase: 6 Type: FLOW-CREATION Subtype: Result: ALLOW Config: Additional Information: New flow created with id 282, packet dispatched to next module Phase: 7 Type: EXTERNAL-INSPECT Subtype: Result: ALLOW Config: Additional Information: Application: 'SNORT Inspect' Phase: 8 Type: SNORT Subtype: Result: ALLOW Config: Additional Information: Snort Verdict: (pass-packet) allow this packet Phase: 9 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Result: input-interface: OUTSIDE input-status: up input-line-status: up Action: allow 1 packet shown >
通过跟踪第二个捕获的数据包,可以显示数据包与当前连接匹配,因此它会绕过ACL检查,但仍会由Snort引擎进行检查:
> show capture CAPI packet-number 2 trace 3 packets captured 2: 15:27:54.330000 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: FLOW-LOOKUP Subtype:ing Result: ALLOW Config: Additional Information: Found flow with id 282, using current flow Phase: 4 Type: EXTERNAL-INSPECT Subtype: Result: ALLOW Config: Additional Information: Application: 'SNORT Inspect' Phase: 5 Type: SNORT Subtype: Result: ALLOW Config: Additional Information: Snort Verdict: (pass-packet) allow this packet Phase: 6 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Result: input-interface: OUTSIDE input-status: up input-line-status: up Action: allow 1 packet shown >
防火墙引擎调试针对FTD Snort引擎的特定组件(如图中所示的访问控制策略)运行:
通过内联对发送TCP SYN/ACK数据包时,可以在调试输出中看到:
> system support firewall-engine-debug
Please specify an IP protocol: tcp
Please specify a client IP address:
Please specify a client port:
Please specify a server IP address: 192.168.201.60
Please specify a server port: 80
Monitoring firewall engine debug messages
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 New session
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 using HW or preset rule order 3, id 268438528 action Allow and prefilter rule 0
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 allow action
192.168.201.60-80 > 192.168.201.50-20 6 AS 4 I 12 Deleting session
启用FTD上的缓冲区日志并关闭连接到e1/6接口的交换机端口。在FTD CLI上,您必须看到两个接口都关闭:
> show interface ip brief
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Internal-Data0/2 169.254.1.1 YES unset up up
Ethernet1/6 unassigned YES unset down down
Ethernet1/7 unassigned YES unset up up
Ethernet1/8 unassigned YES unset administratively down up
>
FTD日志显示:
> show log
Jan 03 2017 15:53:19: %ASA-4-411002: Line protocol on Interface Ethernet1/6, changed state to down
Jan 03 2017 15:53:19: %ASA-4-411004: Interface OUTSIDE, changed state to administratively down
Jan 03 2017 15:53:19: %ASA-4-411004: Interface Ethernet1/8, changed state to administratively down
Jan 03 2017 15:53:19: %ASA-4-812005: Link-State-Propagation activated on inline-pair due to failure of interface Ethernet1/6(INSIDE) bringing down pair interface Ethernet1/8(OUTSIDE)
>
内联集状态显示两个接口成员的状态:
> show inline-set
Inline-set Inline-Pair-1
Mtu is 1500 bytes
Failsafe mode is on/activated
Failsecure mode is off
Tap mode is off
Propagate-link-state option is on
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/6 "INSIDE"
Current-Status: Down(Propagate-Link-State-Activated)
Interface: Ethernet1/8 "OUTSIDE"
Current-Status: Down(Down-By-Propagate-Link-State)
Bridge Group ID: 509
>
注意2个接口状态的差异:
> show interface e1/6
Interface Ethernet1/6 "INSIDE", is down, line protocol is down
Hardware is EtherSVI, BW 1000 Mbps, DLY 1000 usec
MAC address 5897.bdb9.770e, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
Propagate-Link-State-Activated
IP address unassigned
Traffic Statistics for "INSIDE":
3393 packets input, 234923 bytes
120 packets output, 49174 bytes
1 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 6 bytes/sec
5 minute output rate 0 pkts/sec, 3 bytes/sec
5 minute drop rate, 0 pkts/sec
>
对于Ethernet1/8接口:
> show interface e1/8
Interface Ethernet1/8 "OUTSIDE", is administratively down, line protocol is up
Hardware is EtherSVI, BW 1000 Mbps, DLY 1000 usec
MAC address 5897.bdb9.774d, MTU 1500
IPS Interface-Mode: inline, Inline-Set: Inline-Pair-1
Down-By-Propagate-Link-State
IP address unassigned
Traffic Statistics for "OUTSIDE":
120 packets input, 46664 bytes
3391 packets output, 298455 bytes
0 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 3 bytes/sec
5 minute output rate 0 pkts/sec, 8 bytes/sec
5 minute drop rate, 0 pkts/sec
>
重新启用交换机端口后,FTD日志显示:
> show log
...
Jan 03 2017 15:59:35: %ASA-4-411001: Line protocol on Interface Ethernet1/6, changed state to up
Jan 03 2017 15:59:35: %ASA-4-411003: Interface Ethernet1/8, changed state to administratively up
Jan 03 2017 15:59:35: %ASA-4-411003: Interface OUTSIDE, changed state to administratively up
Jan 03 2017 15:59:35: %ASA-4-812006: Link-State-Propagation de-activated on inline-pair due to recovery of interface Ethernet1/6(INSIDE) bringing up pair interface Ethernet1/8(OUTSIDE)
>
解决方案
内联、内联分路器或被动模式下运行的接口不支持NAT:
创建阻止规则,通过FTD内联对发送流量并观察行为,如图所示。
解决方案
通过跟踪启用捕获,并通过FTD内联对发送SYN/ACK数据包。流量被阻止:
> show capture capture CAPI type raw-data trace interface INSIDE [Capturing - 210 bytes] match ip host 192.168.201.60 any capture CAPO type raw-data interface OUTSIDE [Capturing - 0 bytes] match ip host 192.168.201.60 any
通过跟踪,数据包可以显示:
> show capture CAPI packet-number 1 trace
3 packets captured
1: 16:12:55.785085 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) ack 0 win 8192
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: NGIPS-MODE
Subtype: ngips-mode
Result: ALLOW
Config:
Additional Information:
The flow ingressed an interface configured for NGIPS mode and NGIPS services is applied
Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: DROP
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced deny ip 192.168.201.0 255.255.255.0 any rule-id 268441600 event-log flow-start
access-list CSM_FW_ACL_ remark rule-id 268441600: ACCESS POLICY: FTD4100 - Mandatory/1
access-list CSM_FW_ACL_ remark rule-id 268441600: L4 RULE: Rule 1
Additional Information:
Result:
input-interface: INSIDE
input-status: up
input-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
1 packet shown
在此跟踪中,可以看到,数据包被FTD LINA引擎丢弃,并且未转发到FTD Snort引擎。
在内联对上启用分路模式。
解决方案
导航到设备>设备管理>内联集>编辑内联集>高级并启用分路模式,如图所示。
确认
> show inline-set Inline-set Inline-Pair-1 Mtu is 1500 bytes Failsafe mode is on/activated Failsecure mode is off Tap mode is on Propagate-link-state option is on hardware-bypass mode is disabled Interface-Pair[1]: Interface: Ethernet1/6 "INSIDE" Current-Status: UP Interface: Ethernet1/8 "OUTSIDE" Current-Status: UP Bridge Group ID: 0 >
基本原理
最后一点如图所示:
带分路模式的内联对不会丢弃中转流量。通过数据包的跟踪,可以确认以下情况:
> show capture CAPI packet-number 2 trace 3 packets captured 2: 13:34:30.685084 192.168.201.50.20 > 192.168.201.60.80: S 0:0(0) win 8192 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: NGIPS-MODE Subtype: ngips-mode Result: ALLOW Config: Additional Information: The flow ingressed an interface configured for NGIPS mode and NGIPS services is applied Phase: 4 Type: ACCESS-LIST Subtype: log Result: WOULD HAVE DROPPED Config: access-group CSM_FW_ACL_ global access-list CSM_FW_ACL_ advanced deny ip 192.168.201.0 255.255.255.0 any rule-id 268441600 event-log flow-start access-list CSM_FW_ACL_ remark rule-id 268441600: ACCESS POLICY: FTD4100 - Mandatory/1 access-list CSM_FW_ACL_ remark rule-id 268441600: L4 RULE: Rule 1 Additional Information: Result: input-interface: INSIDE input-status: up input-line-status: up Action: Access-list would have dropped, but packet forwarded due to inline-tap 1 packet shown
>
您可以通过两种方式配置与etherchannel的内联对:
SW-A上的Etherchannel:
SW-A# show etherchannel summary | i Po33|Po55 33 Po33(SU) LACP Gi3/11(P) 35 Po35(SU) LACP Gi2/33(P)
SW-B上的Etherchannel:
SW-B# show etherchannel summary | i Po33|Po55 33 Po33(SU) LACP Gi1/0/3(P) 55 Po55(SU) LACP Gi1/0/4(P)
根据MAC地址学习,通过活动FTD转发流量:
SW-B# show mac address-table address 0017.dfd6.ec00 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 201 0017.dfd6.ec00 DYNAMIC Po33 Total Mac Addresses for this criterion: 1
FTD上的内联集:
FTD# show inline-set Inline-set SET1 Mtu is 1500 bytes Fail-open for snort down is on Fail-open for snort busy is off Tap mode is off Propagate-link-state option is off hardware-bypass mode is disabled Interface-Pair[1]: Interface: Port-channel3 "INSIDE" Current-Status: UP Interface: Port-channel5 "OUTSIDE" Current-Status: UP Bridge Group ID: 775
注:在FTD故障切换事件中,流量中断主要取决于交换机获取远程对等体的MAC地址所用的时间。
SW-A上的Etherchannel:
SW-A# show etherchannel summary | i Po33|Po55
33 Po33(SU) LACP Gi3/11(P)
55 Po55(SD) LACP Gi3/7(I)
阻止通过备用FTD的LACP数据包:
FTD# capture ASP type asp-drop fo-standby FTD# show capture ASP | i 0180.c200.0002 29: 15:28:32.658123 a0f8.4991.ba03 0180.c200.0002 0x8809 Length: 124 70: 15:28:47.248262 f0f7.556a.11e2 0180.c200.0002 0x8809 Length: 124
SW-B上的Etherchannel:
SW-B# show etherchannel summary | i Po33|Po55
33 Po33(SU) LACP Gi1/0/3(P)
55 Po55(SD) LACP Gi1/0/4(s)
根据MAC地址学习,通过活动FTD转发流量:
SW-B# show mac address-table address 0017.dfd6.ec00 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 201 0017.dfd6.ec00 DYNAMIC Po33 Total Mac Addresses for this criterion: 1
FTD上的内联集:
FTD# show inline-set
Inline-set SET1
Mtu is 1500 bytes
Fail-open for snort down is on
Fail-open for snort busy is off
Tap mode is off
Propagate-link-state option is off
hardware-bypass mode is disabled
Interface-Pair[1]:
Interface: Ethernet1/3 "INSIDE"
Current-Status: UP
Interface: Ethernet1/5 "OUTSIDE"
Current-Status: UP
Bridge Group ID: 519
注意:在本场景中,如果发生一个FTD故障切换事件,收敛时间主要取决于Etherchannel LACP协商,而根据中断时间,收敛时间可能会相当长。如果Etherchannel模式为ON(no LACP),则收敛时间取决于MAC地址学习。
当前没有可用于此配置的特定信息。
内联对 |
带分路器的内联对 |
|
show inline-set |
> show inline-set |
> show inline-set > |
show interface |
> show interface e1/6 |
> show interface e1/6 |
使用阻止规则处理数据包 |
> show capture CAPI packet-number 1 trace |
> show capture CAPI packet-number 1 trace |
版本 | 发布日期 | 备注 |
---|---|---|
2.0 |
28-Apr-2023 |
重新认证 |
1.0 |
18-Oct-2017 |
初始版本 |