Ensure 'Failover' is enabled

SrednjaNivo 1Automatskacisco-asa

Opis

Enables failover between the security appliance and another security appliance in order to achieve high availability. Enabling failover helps to meet the availability requirement of the security CIA (Confidentiality - Integrity - Availability) triad, ensuring a physical and logical redundancy of firewalls in order to avoid service disruption should the security appliance or ... Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)^failover\s*$

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

! Follow the steps below to enable active/standby failover. The commands are run in the system execution space - Step 1: For each appliance, identify the failover link physical interface <failover_interface_physical> and assign it a name <failover_interface_name> and IP address <failover_interface_ip> and subnet mask <failover_interface_mask>. Identify the other device IP address for each appliance as <peer_failover_ip> - Step 2: For each appliance, identify the state link physical interface <state_interface_physical> and assign it a name <state_interface_name> and IP address <state_interface_ip> and subnet mask <state_interface_mask>. Identify the other device IP address for each appliance as <peer_state_ip> - Step 3: Run the following on the Active device to set it as primary node failover lan unit primary - Step 4: Run the following on the Standby device to set it as secondary node failover lan unit secondary - Step 5: Run the following on both security appliances failover lan interface <failover_interface_name> <failover_interface_physical> failover interface ip <failover_interface_name> <failover_interface_ip> <failover_interface_mask> standby <peer_failover_ip> interface <failover_interface_physical> no shutdown failover link <state_interface_name> <state_interface_physical> failover interface ip <state_interface_name> <state_interface_ip> <state_interface_mask> standby <peer_state_ip> interface <state_interface_physical> no shutdown failover write memory - Step 6: Set up IPSEC preshared key failover ipsec pre-shared-key *

Svojstva

Operativni sistemi: Bilo koji
Oznake: cisco-asanetworkhardening
Referenca: CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.2.3 Ensure 'Failover' is enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target cisco-asa