topic DMZ and Web Server in Network Security

DMZ and Web Server

Navaz Wattoo — Tue, 12 Mar 2019 02:31:11 GMT

i have two cisco ASA 5510 failover firewalls and configured web server in DMZ and the the sh failover is

ACTIVE(config)# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

Unit Poll frequency 1 seconds, holdtime 3 seconds

Interface Poll frequency 3 seconds, holdtime 15 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum

Version: Ours 8.2(5), Mate 8.2(5)

Last Failover at: 09:43:30 PKT Aug 11 2013

This host: Primary - Active

Active time: 1357606 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Up Sys)

Interface DMZ (10.1.1.1): Normal (Waiting)

Interface Outside (125.209.70.90): Normal (Waiting)

Interface inside (192.168.11.249): Normal (Waiting)

slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Up/Up)

IPS, 6.0(6)E4, Up

Other host: Secondary - Failed

Active time: 0 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Unknown/Unknown)

Interface DMZ (10.1.1.2): No Link (Waiting)

Interface Outside (125.209.70.91): Normal

Interface inside (192.168.11.250): Normal

slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Unknown/Unkn

own)

IPS, 6.0(6)E4, Unknown

Stateful Failover Logical Update Statistics

Link : FAILOVER Management0/0 (Failed)

Stateful Obj xmit xerr rcv rerr

General 191867 0 180372 0

sys cmd 180372 0 180372 0

up time 0 0 0 0

RPC services 0 0 0 0

TCP conn 737 0 0 0

UDP conn 603 0 0 0

ARP tbl 10139 0 0 0

Xlate_Timeout 0 0 0 0

IPv6 ND tbl 0 0 0 0

VPN IKE upd 8 0 0 0

VPN IPSEC upd 8 0 0 0

VPN CTCP upd 0 0 0 0

VPN SDI upd 0 0 0 0

VPN DHCP upd 0 0 0 0

SIP Session 0 0 0 0

Logical Update Queue Information

Cur Max Total

Recv Q: 0 17 180372

Xmit Q: 0 1486 1553340

ACTIVE(config)#

and when at web server i have installed linux operating system and at web server there are two LAN cards and i bond these LAN card and one path chord is in active firewall and other firewall is passive.

the problems is that when i i put these two cables are in ASA its will not working and when i un plug one cable its working

Navaz

DMZ and Web Server

Jouni Forss — Tue, 27 Aug 2013 06:34:49 GMT

Hi,

Can't say I have seen a situation where someone would have directly attached an server into an ASA Failover pair. And that is probably where the problem lies.

I would have to guess that the Failover polling messages are not getting through from one ASA to the other ASA since the only link goes through the PC. I have not tried similiar setup every myself and probably wont

- Jouni

DMZ and Web Server

Navaz Wattoo — Tue, 27 Aug 2013 07:04:06 GMT

can u chekc my failover configuration is it right?

ACTIVE(config)# sh failover

Failover On

Failover unit Primary

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

Unit Poll frequency 1 seconds, holdtime 3 seconds

Interface Poll frequency 3 seconds, holdtime 15 seconds

Interface Policy 1

Monitored Interfaces 3 of 110 maximum

Version: Ours 8.2(5), Mate 8.2(5)

Last Failover at: 09:43:30 PKT Aug 11 2013

This host: Primary - Active

Active time: 1357606 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Up Sys)

Interface DMZ (10.1.1.1): Normal (Waiting)

Interface Outside (125.209.70.90): Normal (Waiting)

Interface inside (192.168.11.249): Normal (Waiting)

slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Up/Up)

IPS, 6.0(6)E4, Up

Other host: Secondary - Failed

Active time: 0 (sec)

slot 0: ASA5510 hw/sw rev (2.0/8.2(5)) status (Unknown/Unknown)

Interface DMZ (10.1.1.2): No Link (Waiting)

Interface Outside (125.209.70.91): Normal

Interface inside (192.168.11.250): Normal

slot 1: ASA-SSM-20 hw/sw rev (1.0/6.0(6)E4) status (Unknown/Unkn

own)

IPS, 6.0(6)E4, Unknown

Stateful Failover Logical Update Statistics

Link : FAILOVER Management0/0 (Failed)

Stateful Obj xmit xerr rcv rerr

General 191867 0 180372 0

sys cmd 180372 0 180372 0

up time 0 0 0 0

RPC services 0 0 0 0

TCP conn 737 0 0 0

UDP conn 603 0 0 0

ARP tbl 10139 0 0 0

Xlate_Timeout 0 0 0 0

IPv6 ND tbl 0 0 0 0

VPN IKE upd 8 0 0 0

VPN IPSEC upd 8 0 0 0

VPN CTCP upd 0 0 0 0

VPN SDI upd 0 0 0 0

VPN DHCP upd 0 0 0 0

SIP Session 0 0 0 0

Logical Update Queue Information

Cur Max Total

Recv Q: 0 17 180372

Xmit Q: 0 1486 1553340

ACTIVE(config)#

ACTIVE# sh failover state ?

| Output modifiers

ACTIVE# sh failover state

State Last Failure Reason Date/Time

This host - Primary

Active None

Other host - Secondary

Failed Ifc Failure 02:44:31 PKT Aug 27 2013

DMZ: No Link

====Configuration State===

Sync Done

====Communication State===

ACTIVE#

Navaz

DMZ and Web Server

Jouni Forss — Tue, 27 Aug 2013 07:55:57 GMT

Hi,

Actually I was a bit blind.

It seems to me that the actual Failover link between the devices is not UP either.

Failover LAN Interface: FAILOVER Management0/0 (Failed - No Switchover)

You can check the actual Failover configuration with the command

show run failover

I would also check the actual physical connections as at the moment it seens there are clearly problems with the connectivity between the hosts on certain interfaces.

- Jouni

DMZ and Web Server

Navaz Wattoo — Tue, 27 Aug 2013 11:22:28 GMT

i connected the failover connection through cross cable

and here i paste the configuration of sh run failover

ACTIVE# sh run failover

failover

failover lan unit primary

failover lan interface FAILOVER Management0/0

failover polltime unit 1 holdtime 3

failover polltime interface 3 holdtime 15

failover key *****

failover link FAILOVER Management0/0

failover interface ip FAILOVER 1.1.1.1 255.0.0.0 standby 1.1.1.2

ACTIVE#

Navaz

DMZ and Web Server

Jouni Forss — Tue, 27 Aug 2013 11:43:56 GMT

Hi,

So is the interface Management0/0 up/up? Has it been enabled on both ASAs with the "no shutdown" command?

You can use the command "show run interface Management0/0" on both ASA units.

The configurations seems ok.

- Jouni

Re: DMZ and Web Server

garyprice — Thu, 29 Aug 2013 04:31:22 GMT

How is it possible to use management interface as failover link?

Sent from Cisco Technical Support iPhone App

DMZ and Web Server

Jouni Forss — Thu, 29 Aug 2013 08:03:19 GMT

Hi,

In the original ASA5500 Series it was possible. You could also remove the "management-only" setting.

I have not yet tried on the ASA5500-X Series but to my understanding it cant be used in Failover. Also the "management-only" cant be removed.

- Jouni