禁用ASA上的服務模組監控以避免不需要的故障切換事件(SFR/CX/IPS/CSC)。

簡介

本文描述如何在自適應安全設備(ASA)故障切換環境中禁用模組SourceFire(SFR)、情景感知(CX)、入侵防禦系統(IPS)、內容安全和控制(CSC)上的監控。 

作者：Cesar Lopez，思科TAC工程師。

必要條件

需求

思科建議您瞭解以下主題：

• 自適應安全裝置的配置。
• 高可用性的ASA故障轉移知識。

從版本9.3(1)起，此功能是可配置的。在上述版本之前，將始終監控該模組。因應措施可用於本文檔中所述的先前版本。

採用元件

本檔案以以下軟體和硬體版本為基礎：

• Cisco ASA版本9.3(1)及更高版本。
• 具備FirePOWER服務的ASA 5500-X系列、ASA CX情景感知安全或IPS模組。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路正在作用，請確保您已瞭解任何指令可能造成的影響

背景資訊

預設情況下，ASA監控已安裝的服務模組。如果在主用裝置模組中檢測到故障，則會觸發裝置故障切換。 

當計畫服務模組重新載入或連續模組發生故障時，在不願意進行ASA故障切換事件的情況下，禁用此監視器可能很有幫助。

附註：ASA需要將流量轉向模組，以便由故障轉移過程監控。

設定

網路圖表

本檔案會使用以下設定：

組態

此配置用於實驗裝置，用於演示本文檔中提到的監控功能。僅包括相關配置。此輸出的某些行被省略。 

ASA Version 9.3(3)
!
hostname ASA-FPWR
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.88.247.5 255.255.255.224 standby 10.88.247.6
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.10.111 255.255.255.0 standby 192.168.10.112
!
...
!
interface GigabitEthernet0/6
 description LAN Failover Interface
!
interface GigabitEthernet0/7
 description STATE Failover Interface
!
...

failover
failover lan unit primary
failover lan interface folink GigabitEthernet0/6
failover link statelink GigabitEthernet0/7
failover interface ip folink 1.1.1.1 255.255.255.0 standby 1.1.1.2
failover interface ip statelink 2.2.2.1 255.255.255.0 standby 2.2.2.2
!

...

!
class-map SFR
 match any
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
 message-length maximum client auto
 message-length maximum 512
policy-map global_policy
 class inspection_default
 inspect dns migrated_dns_map_1
 inspect ftp
 inspect h323 h225
 inspect h323 ras
 inspect ip-options
 inspect netbios
 inspect rsh
 inspect rtsp
 inspect skinny
 inspect esmtp
 inspect sqlnet
 inspect sunrpc
 inspect tftp
 inspect sip
 inspect xdmcp
 class SFR
 sfr fail-open
!
service-policy global_policy global
prompt hostname context priority state
no call-home reporting anonymous
Cryptochecksum:b268e0095f175a26aa94d120e9041c29
: end

檢查當前監控的元件。

當ASA處於故障切換模式時，預設情況下會監視安裝的服務模組，就像裝置介面一樣。可使用以下命令檢視監控的目前元件：

ASA-FPWR/pri/act# show run all monitor-interface
monitor-interface outside
monitor-interface inside
monitor-interface service-module

檢查ASA裝置服務模組狀態。 

show failover輸出會顯示每個裝置模組的目前狀態：

ASA-FPWR/pri/act# show failover
Failover On
Failover unit Primary
Failover LAN Interface: folink GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(3), Mate 9.3(3)
Last Failover at: 14:30:44 UTC Aug 6 2015
 This host: Primary - Active
 Active time: 85 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.5): Normal (Monitored)
 Interface inside (192.168.10.111): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-152) status (Up/Up)
 ASA FirePOWER, 5.3.1-152, Up
 Other host: Secondary - Standby Ready
 Active time: 396 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.6): Normal (Monitored)
 Interface inside (192.168.10.112): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-155) status (Up/Up)
 ASA FirePOWER, 5.3.1-155, Up

如果主用裝置的服務模組關閉，將會發生故障切換事件。主用裝置變為備用裝置，而上一個備用裝置則成為主用裝置。在某些情況下，這會導致狀態故障切換不支援的某些功能重新收斂。 

驗證服務模組故障模式策略：

如果使用fail-openpolicy將流量傳送到模組，則流量繼續通過ASA而不傳送到服務模組。這樣可以更透明地克服預期的模組關閉狀態。 

警告：如果應用了失效關閉策略，則ASA會丟棄與用於將流量轉移到模組的類對映匹配的所有流量。 

若要瞭解使用的策略狀態，請運行命令show service-policy [sfr|cx|ips|csc] 。

ASA-FPWR/pri/act# show service-policy sfr

Global policy:
 Service-policy: global_policy
 Class-map: SFR
 SFR: card status Up, mode fail-open
 packet input 0, packet output 0, drop 0, reset-drop 0

 通過檢查模組化策略框架(MPF)配置可以看到相同的情況：

ASA-FPWR/pri/act# show run policy-map
!
policy-map type inspect dns migrated_dns_map_1
 parameters
 message-length maximum client auto
 message-length maximum 512
policy-map global_policy
 class inspection_default
 inspect dns migrated_dns_map_1
 inspect ftp
 inspect h323 h225
 inspect h323 ras
 inspect ip-options
 inspect netbios
 inspect rsh
 inspect rtsp
 inspect skinny
 inspect esmtp
 inspect sqlnet
 inspect sunrpc
 inspect tftp
 inspect sip
 inspect xdmcp
 class SFR
 sfr fail-open
!
ASA-FPWR/pri/act#

禁用服務模組監視。

此命令使故障切換過程停止對服務模組的監視。如果模組進入「關閉」或「無響應」狀態，則無需故障切換即可對模組執行任何計畫的重新載入或故障排除。

no monitor-interface service-module

驗證

驗證服務模組監控是否已禁用。

在執行配置下，monitor-interface命令被否定。  

ASA-FPWR/pri/act(config)# show run all monitor-interface
monitor-interface outside
monitor-interface inside
no monitor-interface service-module

測試重新載入由主用裝置託管的模組。

出於演示目的，將重新載入此裝置上的FirePOWER模組，以確認主用故障切換裝置是否保留此角色。

ASA主/主用裝置中FirePOWER模組的輸出。

Sourcefire ASA5545 v5.3.1 (build 152)

Last login: Thu Aug 6 14:40:46 on ttyS1
>
> system reboot
This command will reboot the system. Continue?
Please enter 'YES' or 'NO': YES

Broadcast message from root (Thu Aug 6 14:40:59 2015):

The system is going down for reboot NOW!

Escape Sequence detected
Console session with module sfr terminated.

模組重新載入時ASA主/主用裝置的輸出。 

裝置仍處於「活動」角色。 

ASA-FPWR/pri/act# show failover
Failover On
Failover unit Primary
Failover LAN Interface: folink GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(3), Mate 9.3(3)
Last Failover at: 14:30:44 UTC Aug 6 2015
 This host: Primary - Active
 Active time: 616 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.5): Normal (Monitored)
 Interface inside (192.168.10.111): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-152) status (Unresponsive/Down)
 ASA FirePOWER, 5.3.1-152, Not Applicable
 Other host: Secondary - Standby Ready
 Active time: 396 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.6): Normal (Monitored)
 Interface inside (192.168.10.112): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-155) status (Up/Up)
 ASA FirePOWER, 5.3.1-155, Up

模組重新載入時ASA輔助/備用裝置的輸出：

備用裝置未將此狀態檢測為故障，並且未承擔活動角色。

ASA-FPWR/sec/stby# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: folink GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(3), Mate 9.3(3)
Last Failover at: 14:30:59 UTC Aug 6 2015
 This host: Secondary - Standby Ready
 Active time: 396 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.6): Normal (Monitored)
 Interface inside (192.168.10.112): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-155) status (Up/Up)
 ASA FirePOWER, 5.3.1-155, Up
 Other host: Primary - Active
 Active time: 670 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.5): Normal (Monitored)
 Interface inside (192.168.10.111): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-152) status (Unresponsive/Down)
 ASA FirePOWER, 5.3.1-152, Not Applicable

啟用服務模組監視。

要啟用模組監視，請運行以下命令：

monitor-interface service-module

驗證服務模組是否已啟用。

不再否定服務模組指令。  

ASA-FPWR/pri/act(config)# show run all monitor-interface
monitor-interface outside
monitor-interface inside
monitor-interface service-module

疑難排解

問題1. ASA繼續故障轉移，並顯示以下消息「Service card in other unit has failed」（其他裝置中的服務卡出現故障）。

如果檢測到一個或多個故障切換事件，則可以使用show failover history來瞭解可能的原因。 

ASA-FPWR/sec/act# show failover history
==========================================================================
From State To State Reason
==========================================================================
14:38:58 UTC Aug 5 2015
Bulk Sync Standby Ready Detected an Active mate

14:39:05 UTC Aug 5 2015
Standby Ready Bulk Sync No Error

14:39:17 UTC Aug 5 2015
Bulk Sync Standby Ready No Error

14:48:12 UTC Aug 6 2015
Standby Ready Just Active Service card in other unit has failed

14:48:12 UTC Aug 6 2015
Just Active Active Drain Service card in other unit has failed

14:48:12 UTC Aug 6 2015
Active Drain Active Applying Config Service card in other unit has failed

14:48:12 UTC Aug 6 2015
Active Applying Config Active Config Applied Service card in other unit has failed

14:48:12 UTC Aug 6 2015
Active Config Applied Active Service card in other unit has failed

現在備用裝置顯示以下消息：

14:47:56 UTC Aug 6 2015
Standby Ready Failed Detect service card failure

如果出現「Service card in other unit has failed（其它裝置中的服務卡出現故障）」消息，則發生故障轉移，因為主用裝置檢測到自己的模組沒有響應。 

如果模組處於「無響應」狀態，則受影響的ASA將處於失敗模式。

ASA-FPWR/sec/stby# Waiting for the earlier webvpn instance to terminate...
Previous instance shut down. Starting a new one.

 Switching to Active

ASA-FPWR/sec/act#
ASA-FPWR/sec/act# show failover
Failover On
Failover unit Secondary
Failover LAN Interface: folink GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(3), Mate 9.3(3)
Last Failover at: 14:24:23 UTC Aug 6 2015
 This host: Secondary - Active
 Active time: 38 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.5): Normal (Waiting)
 Interface inside (192.168.10.111): Normal (Waiting)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-155) status (Up/Up)
 ASA FirePOWER, 5.3.1-155, Up
 Other host: Primary - Failed
 Active time: 182 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.6): Normal (Waiting)
 Interface inside (192.168.10.112): Normal (Waiting)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-152) status (Unresponsive/Down)
 ASA FirePOWER, 5.3.1-152, Not Applicable

解決方案

可以禁用服務模組監視，同時還可以執行進一步的步驟以解決問題，以便恢復模組。

no monitor-interface service-module

問題2：我的ASA不支援9.3(1)，或者我無法升級它。如何避免故障切換事件？ 

舊版ASA5500系列不支援9.3(1)版本，即使它們不支援軟體模組，也有些具有硬體模組，如CSC或IPS。 

即使採用新的ASA5500-X系列，也有一些裝置的版本低於支援禁用監控的裝置。 

解決方案

ASA僅監控模組，前提是有策略配置為將流量傳遞到模組。因此，為了避免故障轉移，可以刪除模組策略。

標識使用的類對映和策略。

在這種情況下，此配置用於移除FirePOWER模組的流量轉移。

class-map SFR
 match any
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
 message-length maximum client auto
 message-length maximum 512
policy-map global_policy
 class inspection_default
 inspect dns migrated_dns_map_1
 inspect ftp
 inspect h323 h225
 inspect h323 ras
 inspect ip-options
 inspect netbios
 inspect rsh
 inspect rtsp
 inspect skinny
 inspect esmtp
 inspect sqlnet
 inspect sunrpc
 inspect tftp
 inspect sip
 inspect xdmcp
 class SFR
 sfr fail-open
!

 show service-policy [csc|cxsc|ips|sfr] 命令可用於檢測類對映和當前狀態。

ASA-FPWR/pri/act# show service-policy sfr

Global policy:
 Service-policy: global_policy
 Class-map: SFR
 SFR: card status Up, mode fail-open
 packet input 0, packet output 0, drop 0, reset-drop 

禁用到模組的流量重定向。

刪除策略後，不會從ASA向模組傳送其他流量。 

ASA-FPWR/pri/act# conf t
ASA-FPWR/pri/act(config)# policy-map global_policy
ASA-FPWR/pri/act(config-pmap)# class SFR
ASA-FPWR/pri/act(config-pmap-c)# no sfr fail-open
ASA-FPWR/pri/act(config-pmap-c)# end
ASA-FPWR/pri/act#

驗證ASA重定向至模組是否已禁用。

 可以使用相同的show命令來驗證流量是否不再流向模組。輸出必須為空。

 ASA-FPWR/pri/act# show service-policy sfr
ASA-FPWR/pri/act#

 即使模組沒有響應，活動單元仍保持相同的角色。 

ASA-FPWR/pri/act# show module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
 sfr FirePOWER Services Software Module ASA5545 FCH18457CNM

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
 sfr 74a0.2fa4.6c7a to 74a0.2fa4.6c7a N/A N/A 5.3.1-152

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
 sfr ASA FirePOWER Not Applicable 5.3.1-152

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
 sfr Unresponsive Not Applicable

ASA-FPWR/pri/act# show failover
Failover On
Failover unit Primary
Failover LAN Interface: folink GigabitEthernet0/6 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 2 of 316 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(3), Mate 9.3(3)
Last Failover at: 14:51:20 UTC Aug 6 2015
 This host: Primary - Active
 Active time: 428 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.5): Normal (Monitored)
 Interface inside (192.168.10.111): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-152) status (Unresponsive/Down)
 ASA FirePOWER, 5.3.1-152, Not Applicable
 Other host: Secondary - Standby Ready
 Active time: 204 (sec)
 slot 0: ASA5545 hw/sw rev (1.0/9.3(3)) status (Up Sys)
 Interface outside (10.88.247.6): Normal (Monitored)
 Interface inside (192.168.10.112): Normal (Monitored)
 slot 1: SFR5545 hw/sw rev (N/A/5.3.1-155) status (Up/Up)
 ASA FirePOWER, 5.3.1-155, Up

啟用重定向到模組的流量。

需要將流量傳送回模組後，可以重新新增失效開放或失效關閉策略。 

ASA-FPWR/pri/act(config)# policy-map global_policy
ASA-FPWR/pri/act(config-pmap)# class SFR
ASA-FPWR/pri/act(config-pmap-c)# sfr fail-open
ASA-FPWR/pri/act(config-pmap-c)# end
ASA-FPWR/pri/act#