Ensure 'Failover' is enabled

보통레벨 1자동cisco-asa

설명

Enables failover between the security appliance and another security appliance in order to achieve high availability. Enabling failover helps to meet the availability requirement of the security CIA (Confidentiality - Integrity - Availability) triad, ensuring a physical and logical redundancy of firewalls in order to avoid service disruption should the security appliance or ... Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^failover\s*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

! Follow the steps below to enable active/standby failover. The commands are run in the system execution space - Step 1: For each appliance, identify the failover link physical interface <failover_interface_physical> and assign it a name <failover_interface_name> and IP address <failover_interface_ip> and subnet mask <failover_interface_mask>. Identify the other device IP address for each appliance as <peer_failover_ip> - Step 2: For each appliance, identify the state link physical interface <state_interface_physical> and assign it a name <state_interface_name> and IP address <state_interface_ip> and subnet mask <state_interface_mask>. Identify the other device IP address for each appliance as <peer_state_ip> - Step 3: Run the following on the Active device to set it as primary node failover lan unit primary - Step 4: Run the following on the Standby device to set it as secondary node failover lan unit secondary - Step 5: Run the following on both security appliances failover lan interface <failover_interface_name> <failover_interface_physical> failover interface ip <failover_interface_name> <failover_interface_ip> <failover_interface_mask> standby <peer_failover_ip> interface <failover_interface_physical> no shutdown failover link <state_interface_name> <state_interface_physical> failover interface ip <state_interface_name> <state_interface_ip> <state_interface_mask> standby <peer_state_ip> interface <state_interface_physical> no shutdown failover write memory - Step 6: Set up IPSEC preshared key failover ipsec pre-shared-key *

속성

운영 체제: 모두
태그: cisco-asanetworkhardening
참고 자료: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.2.3 Ensure 'Failover' is enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target cisco-asa