配置和驗證ASA/FTD中的PPPoE冗餘/高可用性

已更新: 2026 年 3 月 17 日

文件 ID:225616

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本檔案介紹ASA或安全防火牆威脅防禦(FTD)中的PPPoE備援（高可用性或HA）的設定和驗證。

必要條件

需求

基本產品知識。

採用元件

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

本文中的資訊係根據以下軟體和硬體版本：

安全防火牆威脅防禦(FTD)版本10.0.0，由安全防火牆管理中心(FMC)版本10.0.1管理。
ASA版本9.24.1。

背景資訊

防火牆軟體支援配置多個PPPoE會話。本檔案會考慮2個PPPoE作業階段，而「HA」或「備援」會互換使用。

結合服務層協定(SLA)，跟蹤和帶跟蹤的路由使用者可以配置不同的冗餘模式：

帶有負載共用的主用 — 主用冗餘
帶有負載共用和PPPoE客戶端路由跟蹤的主用 — 主用冗餘
無負載共用的主備冗餘

請注意，在對等裝置上配置路由不在本文的討論範圍之內。

具有負載共用的主動備援

請參閱以下示例拓撲：

Active-Active Redundancy with Load-Sharing 具有負載共用的主動備援

重點：

PPPoE在防火牆outside和outside2介面中進行配置。
RTR1和RTR2是PPPoE伺服器。
防火牆通過outside介面安裝預設路由。通過outside2介面的預設路由具有更高的路由距離，也就是說，不太可取。
通過outside2介面安裝到達特定子網的負載共用靜態路由。將跟蹤路由。跟蹤是可選的；但是，如果通過outside2介面的路徑出現故障，則它通過outside介面提供到路徑的更快的故障切換。
為簡單起見，動態連線埠位址轉譯(PAT)是透過outside和outside2介面進行設定。

ASA配置

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 pppoe client vpdn group RTR1
ip address pppoe setroute

interface GigabitEthernet0/1
 nameif outside2
 security-level 0
 pppoe client vpdn group RTR2
 pppoe client route distance 10
 ip address pppoe setroute

vpdn group RTR1 request dialout pppoe
vpdn group RTR1 localname pppoe
vpdn group RTR1 ppp authentication pap
vpdn group RTR2 request dialout pppoe
vpdn group RTR2 localname pppoe
vpdn username pppoe password *****
sla monitor 1
 type echo protocol ipIcmpEcho 172.16.1.1 interface outside2
 num-packets 2
 timeout 5
 frequency 5

sla monitor schedule 1 life forever start-time now
track 1 rtr 1 reachability

object network net-192.168.1.0
 subnet 192.168.1.0 255.255.255.0

nat (inside,outside) source dynamic net-192.168.1.0 interface
nat (inside,outside2) source dynamic net-192.168.1.0 interface

route outside2 172.16.253.0 255.255.255.0 172.16.1.1 1 track 1

FTD組態

本節僅介紹FTD特定的PPPoE配置。以下是FTD上outside和outside2介面PPPoE組態的並排比較，以及部署到資料平面的命令：

outside PPPoE interface configuration on FMC UI FMC UI上的外部PPPoE介面配置 outside2 PPPoE interface configuration on FMC UI outside2 PPPoE介面在FMC UI上的配置

帶跟蹤的靜態路由：

Static route with tracking 帶跟蹤的靜態路由

SLA監控對象配置：

SLA configuration SLA配置

重點：

RTR1和RTR2分別是G0/0和G0/1介面上的2個VPDN組。
Track 1/SLA1跟蹤到RTR2的可達性。跟蹤對象通過outside2介面用於靜態路由配置。
pppoe client route distance 10 命令指示防火牆將管理距離10應用於從RTR2接收的預設路由，因此使其不太可取。
通過outside2介面到特定子網的路由配置了跟蹤。
因此，兩個PPPoE會話都變為活動狀態，並且來自PC的流量根據路由配置進行負載共用。

驗證

通過外部接口與RTR1建立了PPPoE會話：

firewall# show vpdn session pppoe state 
PPPoE Session Information (Total tunnels=2 sessions=1)

SessID TunID Intf     State       Last Chg
   23      5 outside2   PADI_SENT  225 secs
   14      4 outside  SESSION_UP  150 secs

firewall# show vpdn pppinterface 

PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 33, Received Pkts: 33, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2 was deleted and pending reuse

firewall# show route
…
S*       0.0.0.0 0.0.0.0 [1/0] via 10.10.1.1, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside

系統日誌：

Mar 15 2026 20:23:26: %ASA-6-305009: Built static translation from outside:0.0.0.0 to inside:0.0.0.0
Mar 15 2026 20:23:26: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 4, remote_peer_ip = 10.10.1.1, ppp_virtual_interface_id = 1, client_dynamic_ip = 10.10.1.10, username = pppoe
Mar 15 2026 20:23:26: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 10.10.1.1 [1/0] on [outside] [G0/0] tableid [0

2.通過outside2介面建立與RTR2的PPPoE會話：

firewall# show vpdn session pppoe state 

PPPoE Session Information (Total tunnels=2 sessions=2)

SessID TunID Intf     State       Last Chg
   24      5 outside2  SESSION_UP  76 secs
   14      4 outside  SESSION_UP  349 secs

firewall# show vpdn pppinterface
PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 67, Received Pkts: 67, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2
PPP authentication protocol is PAP
Server ip address is 172.16.1.1
Our ip address is 172.16.1.10
Transmitted Pkts: 54, Received Pkts: 54, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

firewall# show route 
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
…
S*       0.0.0.0 0.0.0.0 [1/0] via 10.10.1.1, outside
S        172.16.253.0 255.255.255.0 [1/0] via 172.16.1.1, outside2
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside

系統日誌：

Mar 15 2026 20:27:59: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 0.0.0.0 [10/0] on [outside2] [G0/1] tableid [0]
Mar 15 2026 20:27:59: %ASA-6-305009: Built static translation from outside2:0.0.0.0 to inside:0.0.0.0
Mar 15 2026 20:27:59: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 5, remote_peer_ip = 172.16.1.1, ppp_virtual_interface_id = 2, client_dynamic_ip = 172.16.1.10, username = pppoe
Mar 15 2026 20:27:59: %ASA-6-305010: Teardown static translation from outside2:0.0.0.0 to inside:0.0.0.0 duration 0:06:08
Mar 15 2026 20:28:04: %ASA-6-622001: Adding tracked route 172.16.253.0 255.255.255.0 172.16.1.1, distance 1, table default, on interface outside2
Mar 15 2026 20:28:04: %ASA-6-317077: Added STATIC route 172.16.253.0 255.255.255.0 via 172.16.1.1 [1/0] on [outside2] [G0/1] tableid [0]

3.從PC IP地址192.168.1.2到10.10.253.2和172.16.253.2的資料包被傳送。由於PAT，capture capo和capo2顯示輸出介面IP地址（對映地址）：

Mar 14 2026 23:13:13: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2668 to outside:10.10.1.10/2668
Mar 14 2026 23:13:19: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2669 to outside2:172.16.1.10/2669

firewall# show cap
capture capo type raw-data interface outside [Capturing - 456 bytes]
  match icmp any host 10.10.253.2
capture capo2 type raw-data interface outside2 [Capturing - 456 bytes]
  match icmp any host 172.16.253.2

firewall# show cap capo
4 packets captured

   1: 23:13:13.409387       10.10.1.10 > 10.10.253.2 icmp: echo request
   2: 23:13:13.417764       10.10.253.2 > 10.10.1.10 icmp: echo reply 
   3: 23:13:14.409799       10.10.1.10 > 10.10.253.2 icmp: echo request
   4: 23:13:14.415978       10.10.253.2 > 10.10.1.10 icmp: echo reply

4 packets shown

firewall# show cap capo2
4 packets captured
   1: 23:13:19.500584       172.16.1.10 > 172.16.253.2 icmp: echo request
   2: 23:13:19.506321       172.16.253.2 > 172.16.1.10 icmp: echo reply
   3: 23:13:20.502201       172.16.1.10 > 172.16.253.2 icmp: echo request
   4: 23:13:20.508076       172.16.253.2 > 172.16.1.10 icmp: echo reply

4.模擬RTR1上的遠端鏈路故障。通過outside2介面故障切換到備份路徑大約需要1分鐘：

RTR1:

Mar 15 20:43:19.679: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

Firewall:

Mar 15 2026 20:44:17: %ASA-3-403503: PPPoE:PPP link down:
Mar 15 2026 20:44:17: %ASA-3-403503: PPPoE:PPP link down:Peer not responding
Mar 15 2026 20:44:17: %ASA-3-403503: PPPoE:PPP link down:
Mar 15 2026 20:44:17: %ASA-3-403503: PPPoE:PPP link down:LCP down
Mar 15 2026 20:44:17: %ASA-6-603109: Teardown PPPOE Tunnel, tunnel_id = 4, remote_peer_ip = 10.10.1.1
Mar 15 2026 20:44:17: %ASA-6-305009: Built static translation from outside:0.0.0.0 to inside:0.0.0.0
Mar 15 2026 20:44:17: %ASA-6-317078: Deleted STATIC route 0.0.0.0 0.0.0.0 via 10.10.1.1 [1/0] on [outside] [G0/0] tableid [0]
Mar 15 2026 20:44:17: %ASA-7-110007: Del Entry:0.0.0.0/0.0.0.0 nh:10.10.1.1 nh_cnt:1 flags:0 timestamp:147 resolver_cnt:0 ifcout:outside result:1 incr_ts:1 vrfid:65535
Mar 15 2026 20:44:17: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 172.16.1.1 [10/0] on [outside2] [G0/1] tableid [0]
Mar 15 2026 20:44:17: %ASA-7-110006: Add Entry:0.0.0.0/0.0.0.0 nh:172.16.1.1 nh_cnt:1 flags:0 timestamp:151 resolver_cnt:0 ifcout:outside2 vrfid:1644313584 handle:103727 table:output route
Mar 15 2026 20:44:17: %ASA-6-305010: Teardown static translation from outside:0.0.0.0 to inside:0.0.0.0 duration 0:02:45

firewall# show route 
…
S*       0.0.0.0 0.0.0.0 [10/0] via 172.16.1.1, outside2

帶有負載共用和PPPoE客戶端路由跟蹤的主用 — 主用冗餘

此案例基於帶有負載共用的主用 — 主用冗餘，並且還需要使用FlexConfig在外部介面下部署額外的track和pppoe client route track x命令。

請參閱以下示例拓撲：

Active-Active Redundancy with Load-Sharing and PPPoE Client Route Tracking 帶有負載共用和PPPoE客戶端路由跟蹤的主用 — 主用冗餘

重點：

PPPoE在防火牆outside和outside2介面中進行配置。
RTR1和RTR2是PPPoE伺服器。
使用route-distance，防火牆通過outside介面安裝預設路由。通過outside2介面的預設路由具有更高的路由距離，不盡如人意。
將跟蹤通過外部介面到RTR1的預設路由。它是可選的，但根據SLA頻率和超時值，它可以通過RTR2更快地故障切換到路徑。
通過outside2介面安裝到達特定子網的負載共用靜態路由。將跟蹤路由。跟蹤是可選的；但是，它通過RTR1提供了到路徑的更快的故障切換。
為簡單起見，動態連線埠位址轉譯(PAT)是透過outside和outside2介面進行設定。

ASA配置

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 pppoe client vpdn group RTR1
 pppoe client route track 2
 ip address pppoe setroute

interface GigabitEthernet0/1
 nameif outside2
 security-level 0
 pppoe client vpdn group RTR2
 pppoe client route distance 10
 ip address pppoe setroute

vpdn group RTR1 request dialout pppoe
vpdn group RTR1 localname pppoe
vpdn group RTR1 ppp authentication pap
vpdn group RTR2 request dialout pppoe
vpdn group RTR2 localname pppoe
vpdn username pppoe password *****

sla monitor 2
 type echo protocol ipIcmpEcho 10.10.1.1 interface outside
 num-packets 2
 timeout 5
 frequency 5

sla monitor schedule 2 life forever start-time now

sla monitor 1
 type echo protocol ipIcmpEcho 172.16.1.1 interface outside2
 num-packets 2
 timeout 5
 frequency 5
sla monitor schedule 1 life forever start-time now

track 1 rtr 1 reachability
track 2 rtr 2 reachability

object network net-192.168.1.0
 subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source dynamic net-192.168.1.0 interface
nat (inside,outside2) source dynamic net-192.168.1.0 interface

route outside2 172.16.253.0 255.255.255.0 172.16.1.1 1 track 1

FTD組態

本節僅涵蓋FTD特定的PPPoE配置。配置步驟與「使用負載共用的主用 — 主用冗餘」一節中的FTD配置相同，只是在outside介面下增加了pppoe client route track x 命令的部署。由於FMC UI本身不支援對客戶端選項的跟蹤，因此必須使用FlexConfig。

確保考慮以下幾點：

1. FlexConfig策略故意不包含廣泛的輸入驗證。必須確保此FlexConfig策略中的配置正確。不正確的配置會導致部署失敗，從而造成網路中斷。此外，請考慮隔離部署，使其僅包含FlexConfig更改，而不包含其他策略更新。

2.部署期間，FMC刪除任何軌道x..命令部署在FlexConfig。對於永續性，您必須將FlexConfig對象的部署設定為Everytime，並在單獨的FlexConfig對象中進行部署。

FlexConfig配置步驟

1.為外部介面的SLA和PPPoE客戶端配置配置建立FlexConfig對象。確保將「部署」設定為Once，將Type設定為Append。在此示例中，使用了路徑2、SLA 2。請注意，缺少track 2 rtr 2 reachability命令：

適用於SLA的FlexConfig

2.建立另一個FlexConfig對象，以配置track 2 rtr 2 reachability命令。確保將Deployment設定為Everytime，並將Type設定為Append:

FlexConfig for track 適用於磁軌的FlexConfig

3.將對象新增到FlexConfig策略。確保在底部（最後）使用track 2 rtr 2 reachability命令確保對象，並部署策略：

FlexConfig policy FlexConfig策略

重點：

RTR1和RTR2分別是G0/0和G0/1介面上的2個VPDN組。
Track 2/SLA2跟蹤RTR1的可達性。 pppoe client route track 2 命令指示防火牆在跟蹤2啟動時通過外部介面安裝預設路由。
Track 1/SLA1跟蹤到RTR2的可達性。跟蹤對象通過outside2介面用於靜態路由配置。
pppoe client route distance 10 命令指示防火牆將管理距離10應用到從RTR2接收的預設路由，因此它不是那麼可取。
通過outside2介面到特定子網的路由配置了跟蹤。
因此，兩個PPPoE會話都變為活動狀態，並且來自PC的流量根據路由配置進行負載共用。

驗證

1.建立通過外部介面與RTR1的PPPoE會話：

firewall# show vpdn session pppoe state
PPPoE Session Information (Total tunnels=2 sessions=1)


SessID TunID Intf     State       Last Chg
   12      3 outside  SESSION_UP  80 secs
   12      4 outside2   PADI_SENT  74 secs

firewall# show vpdn pppinterface       

PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 71, Received Pkts: 71, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2 was deleted and pending reuse


firewall# show route 
…
S*       0.0.0.0 0.0.0.0 [1/0] via 10.10.1.1, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside

系統日誌：

Mar 14 2026 22:54:46: %ASA-4-411001: Line protocol on Interface GigabitEthernet0/0, changed state to up
Mar 14 2026 22:54:50: %ASA-6-305009: Built static translation from outside:0.0.0.0 to inside:0.0.0.0
Mar 14 2026 22:54:50: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 3, remote_peer_ip = 10.10.1.1, ppp_virtual_interface_id = 1, client_dynamic_ip = 10.10.1.10, username = pppoe
Mar 14 2026 22:54:51: %ASA-6-305010: Teardown static translation from outside:0.0.0.0 to inside:0.0.0.0 duration 0:00:25
Mar 14 2026 22:54:52: %ASA-6-622001: Adding tracked route 0.0.0.0 0.0.0.0 10.10.1.1, distance 1, table default, on interface outside
Mar 14 2026 22:54:52: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 10.10.1.1 [1/0] on [outside] [Gi0/0] tableid [0]
Mar 14 2026 22:54:52: %ASA-7-110006: Add Entry:0.0.0.0/0.0.0.0 nh:10.10.1.1 nh_cnt:1 flags:0 timestamp:328 resolver_cnt:0 ifcout:outside vrfid:0 handle:444749 table:output route

2.通過outside2介面建立與RTR2的PPPoE會話：

firewall# show vpdn session pppoe state 
PPPoE Session Information (Total tunnels=2 sessions=2)
SessID TunID Intf     State       Last Chg
   12      3 outside  SESSION_UP  412 secs
   13      4 outside2  SESSION_UP  89 secs

firewall# show vpdn pppinterface       
PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 238, Received Pkts: 238, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2
PPP authentication protocol is PAP
Server ip address is 172.16.1.1
Our ip address is 172.16.1.10
Transmitted Pkts: 56, Received Pkts: 56, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

firewall# show route 

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.10.1.1 to network 0.0.0.0

S*       0.0.0.0 0.0.0.0 [1/0] via 10.10.1.1, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside
S        172.16.253.0 255.255.255.0 [1/0] via 172.16.1.1, outside2

系統日誌：

Mar 14 2026 22:59:45: %ASA-4-411001: Line protocol on Interface GigabitEthernet0/1, changed state to up
Mar 14 2026 23:00:13: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 4, remote_peer_ip = 172.16.1.1, ppp_virtual_interface_id = 2, client_dynamic_ip = 172.16.1.10, username = pppoe
Mar 14 2026 23:00:14: %ASA-6-305010: Teardown static translation from outside2:0.0.0.0 to inside:0.0.0.0 duration 0:25:25
Mar 14 2026 23:00:18: %ASA-6-622001: Adding tracked route 172.16.253.0 255.255.255.0 172.16.1.1, distance 1, table default, on interface outside2
Mar 14 2026 23:00:18: %ASA-6-317077: Added STATIC route 172.16.253.0 255.255.255.0 via 172.16.1.1 [1/0] on [outside2] [Gi0/1] tableid [0]
Mar 14 2026 23:00:18: %ASA-7-110006: Add Entry:172.16.253.0/255.255.255.0 nh:172.16.1.1 nh_cnt:1 flags:0 timestamp:339 resolver_cnt:0 ifcout:outside2 vrfid:0 handle:458877 table:output route

3.從PC IP地址192.168.1.2到10.10.253.2和172.16.253.2的資料包被傳送。由於PAT，capture capo和capo2顯示輸出介面IP地址（對映地址）：

Mar 14 2026 23:13:13: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2668 to outside:10.10.1.10/2668
Mar 14 2026 23:13:19: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2669 to outside2:172.16.1.10/2669

firewall# show cap
capture capo type raw-data interface outside [Capturing - 456 bytes]
  match icmp any host 10.10.253.2
capture capo2 type raw-data interface outside2 [Capturing - 456 bytes]
  match icmp any host 172.16.253.2

firewall# show cap capo
4 packets captured

   1: 23:13:13.409387       10.10.1.10 > 10.10.253.2 icmp: echo request
   2: 23:13:13.417764       10.10.253.2 > 10.10.1.10 icmp: echo reply 
   3: 23:13:14.409799       10.10.1.10 > 10.10.253.2 icmp: echo request
   4: 23:13:14.415978       10.10.253.2 > 10.10.1.10 icmp: echo reply

4 packets shown

firewall# show cap capo2
4 packets captured

   1: 23:13:19.500584       172.16.1.10 > 172.16.253.2 icmp: echo request
   2: 23:13:19.506321       172.16.253.2 > 172.16.1.10 icmp: echo reply
   3: 23:13:20.502201       172.16.1.10 > 172.16.253.2 icmp: echo request
   4: 23:13:20.508076       172.16.253.2 > 172.16.1.10 icmp: echo reply

4.在RTR1上模擬遠端鏈路故障。通過outside2介面故障切換到備份路徑取決於track1的計時器：

RTR1:

Mar 15 21:06:11.608: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet0/0/0, changed state to down

Firewall:

Mar 15 2026 21:06:14: %ASA-3-317012: Interface IP route counter negative - Ethernet1/2
Mar 15 2026 21:06:14: %ASA-6-622001: Removing tracked route 0.0.0.0 0.0.0.0 10.10.1.1, distance 1, table default, on interface outside
Mar 15 2026 21:06:14: %ASA-6-317078: Deleted STATIC route 0.0.0.0 0.0.0.0 via 10.10.1.1 [1/0] on [outside] [E1/2] tableid [0]
Mar 15 2026 21:06:14: %ASA-7-110007: Del Entry:0.0.0.0/0.0.0.0 nh:10.10.1.1 nh_cnt:1 flags:0 timestamp:199 resolver_cnt:0 ifcout:outside result:1 incr_ts:1 vrfid:0
Mar 15 2026 21:06:14: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 172.16.1.1 [10/0] on [outside2] [E1/3] tableid [0]
Mar 15 2026 21:06:14: %ASA-7-110006: Add Entry:0.0.0.0/0.0.0.0 nh:172.16.1.1 nh_cnt:1 flags:0 timestamp:203 resolver_cnt:0 ifcout:outside2 vrfid:1512689936 handle:117182335 table:output route

KSEC-CSF1210-1# show route 
…
S*       0.0.0.0 0.0.0.0 [10/0] via 172.16.1.1, outside2

附註：

路由更改不會應用於現有連線。因此，即使有更好的路徑可用，現有連線仍繼續使用「舊」路徑。實際上，這可能在路由更改後造成影響。要指示防火牆使用新路徑，請考慮啟用浮動連線計時器。如果啟用了浮動連線超時，並將其設定為非零值，則如果有更好的路由可用，則此超時允許連線關閉，以便可以重新建立連線以使用更好的路由。請參閱https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/T-Z/asa-command-ref-T-Z/m_ta-tk.html中浮接頭的說明。

無負載共用的主備冗餘

在這種情況下，只有1個PPPoE會話處於活動狀態，而另一個會話處於非活動狀態，直到活動會話的跟蹤關閉。

pppoe client secondary track x命令用於outside2(backup)介面。

請參閱以下示例拓撲：

Active standby topology 活動備用拓撲

重點：

在防火牆G0/0和G0/1介面中配置PPPoE。
RTR1和RTR2是PPPoE伺服器。
使用路由距離，防火牆通過outside介面安裝到RTR1的預設路由。通向RTR2的預設路由具有更高的路由距離，因此不太理想。
將跟蹤通過outside介面到RTR1的預設路由。它是可選的，但它通過RTR2提供了更快的路徑故障切換。
僅當用於通過外部介面到RTR1的預設路由的路徑關閉時，才會建立通過outside2介面到RTR2的PPPoE會話。
在指定的時間，只有1個PPPoE會話處於活動狀態。
為簡單起見，動態連線埠位址轉譯(PAT)是透過outside和outside2介面進行設定。

ASA配置

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 pppoe client vpdn group RTR1
 pppoe client route track 2
 ip address pppoe setroute

interface GigabitEthernet0/1
 nameif outside2
 security-level 0
 pppoe client vpdn group RTR2
 pppoe client route distance 10
 pppoe client secondary track 2
 ip address pppoe setroute

vpdn group RTR1 request dialout pppoe
vpdn group RTR1 localname pppoe
vpdn group RTR1 ppp authentication pap
vpdn group RTR2 request dialout pppoe
vpdn group RTR2 localname pppoe
vpdn username pppoe password *****

sla monitor 2
 type echo protocol ipIcmpEcho 10.10.1.1 interface outside
 num-packets 2
 timeout 5
 frequency 5
sla monitor schedule 2 life forever start-time now

track 2 rtr 2 reachability

object network net-192.168.1.0
 subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source dynamic net-192.168.1.0 interface
nat (inside,outside2) source dynamic net-192.168.1.0 interface

FTD組態

本節介紹outside2（備份）介面的pppoe client secondary track x命令的配置。由於FMC UI本身不支援對客戶端選項的跟蹤，因此必須使用FlexConfig。

必須確保配置其餘配置，包括PPPoE配置、路由和其他配置。

確保考慮以下幾點：

FlexConfig策略故意不包含廣泛的輸入驗證。必須確保此FlexConfig策略中的配置正確。不正確的配置會導致部署失敗，從而造成網路中斷。此外，請考慮隔離部署，使其僅包含FlexConfig更改，而不包含其他策略更新。
部署期間，FMC將刪除任何軌道x。命令部署在FlexConfig。對於永續性，您必須將FlexConfig對象的部署設定為Everytime，並在單獨的FlexConfig對象中進行部署。

FlexConfig配置步驟

1.為outside2(備份)介面的SLA和PPPoE客戶端配置配置建立FlexConfig對象。確保將Deployment設定為Once，將Type設定為Append。在此示例中，使用路徑2、SLA 2。請注意，缺少track 2 rtr 2 reachability命令：

適用於SLA的FlexConfig

2.建立另一個FlexConfig對象，以配置track 2 rtr 2 reachability命令。確保將Deployment設定為Everytime，並將Type設定為Append:

適用於磁軌的FlexConfig

3.將對象新增到FlexConfig策略。確保在底部（最後）使用track 2 rtr 2 reachability命令確保對象，並部署策略：

FlexConfig policy FlexConfig策略

重點：

G0/1 介面下的pppoe client secondary track 2 命令指示防火牆僅在路徑2失敗時通過G0/1介面啟用PPPoE會話。跟蹤通過主路徑的可達性的軌道2的故障有效地啟用了備份路徑。
因此，在給定時間只有1個PPPoE會話處於活動狀態。

驗證

1.已建立通過外部接口與RTR1的PPPoE會話。備份會話處於空閒狀態：

firewall# show vpdn session pppoe state 

PPPoE Session Information (Total tunnels=1 sessions=1)

SessID TunID Intf     State       Last Chg
   13      3 outside  SESSION_UP  72 secs


firewall# show vpdn pppinterface

PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 60, Received Pkts: 60, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2 was deleted and pending reuse

2.通過outside介面到RTR1的PPPoE會話失敗（例如，由於物理介面或鏈路故障）。建立通過outside2介面到RTR2的PPPoE會話。

系統日誌：

Mar 14 2026 23:40:50: %ASA-3-403503: PPPoE:PPP link down:Peer not responding
Mar 14 2026 23:40:50: %ASA-3-403503: PPPoE:PPP link down:
Mar 14 2026 23:40:50: %ASA-3-403503: PPPoE:PPP link down:LCP down
Mar 14 2026 23:40:50: %ASA-6-603109: Teardown PPPOE Tunnel, tunnel_id = 3, remote_peer_ip = 10.10.1.1
Mar 14 2026 23:40:50: %ASA-6-305009: Built static translation from outside:0.0.0.0 to inside:0.0.0.0
Mar 14 2026 23:39:44: %ASA-4-411002: Line protocol on Interface GigabitEthernet0/0, changed state to down
Mar 14 2026 23:39:44: %ASA-7-713906: IKE Receiver: Interface 3(outside) going down
Mar 14 2026 23:39:44: %ASA-3-317012: Interface IP route counter negative - GigabitEthernet0/0
Mar 14 2026 23:39:44: %ASA-6-317078: Deleted STATIC route 0.0.0.0 0.0.0.0 via 10.10.1.1 [1/0] on [outside] [Gi0/0] tableid [0]
Mar 14 2026 23:39:44: %ASA-7-110007: Del Entry:0.0.0.0/0.0.0.0 nh:10.10.1.1 nh_cnt:1 flags:0 timestamp:451 resolver_cnt:0 ifcout:outside result:1 incr_ts:1 vrfid:0
Mar 14 2026 23:39:48: %ASA-6-622001: Removing tracked route 0.0.0.0 0.0.0.0 10.10.1.1, distance 1, table default, on interface outside
Mar 14 2026 23:39:48: %ASA-6-305009: Built static translation from outside2:0.0.0.0 to inside:0.0.0.0
Mar 14 2026 23:39:48: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 4, remote_peer_ip = 172.16.1.1, ppp_virtual_interface_id = 2, client_dynamic_ip = 172.16.1.10, username = pppoe
Mar 14 2026 23:39:48: %ASA-6-317078: Deleted CONNECTED route 172.16.1.10 255.255.255.255 via 0.0.0.0 [0/0] on [outside2] [Gi0/1] tableid [0]
Mar 14 2026 23:39:48: %ASA-6-317077: Added STATIC route 0.0.0.0 0.0.0.0 via 172.16.1.1 [10/0] on [outside2] [Gi0/1] tableid [0]
Mar 14 2026 23:39:48: %ASA-7-110006: Add Entry:0.0.0.0/0.0.0.0 nh:172.16.1.1 nh_cnt:1 flags:0 timestamp:459 resolver_cnt:0 ifcout:outside2 vrfid:0 handle:610419 table:output route

firewall# show vpdn session pppoe state

PPPoE Session Information (Total tunnels=2 sessions=1)

SessID TunID Intf     State       Last Chg
   13      3 outside   PADI_SENT  0 secs
   14      4 outside2  SESSION_UP  82 secs


firewall# show vpdn pppinterface
PPP virtual interface id = 1 was deleted and pending reuse
PPP virtual interface id = 2
PPP authentication protocol is PAP
Server ip address is 172.16.1.1
Our ip address is 172.16.1.10
Transmitted Pkts: 56, Received Pkts: 56, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

firewall# show route 

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF

Gateway of last resort is 172.16.1.1 to network 0.0.0.0

S*       0.0.0.0 0.0.0.0 [10/0] via 172.16.1.1, outside2
S        172.16.253.0 255.255.255.0 [1/0] via 172.16.1.1, outside2
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside

3.從PC IP地址192.168.1.2到10.10.253.2和172.16.253.2的資料包被傳送。由於主路徑失敗，所有資料包都通過outside2介面傳送。此外，由於PAT，capture capo2顯示輸出介面IP地址（對映地址）：

Mar 14 2026 23:46:07: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2677 to outside2:172.16.1.10/2677
Mar 14 2026 23:46:09: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2678 to outside2:172.16.1.10/2678

firewall# show cap
capture capo type raw-data interface outside [Capturing - 0 bytes]
  match icmp any host 10.10.253.2
capture capo2 type raw-data interface outside2 [Capturing - 912 bytes]
  match icmp any host 172.16.253.2
  match icmp any host 10.10.253.2

firewall# show cap capo2

8 packets captured

   1: 23:46:07.533694       172.16.1.10 > 172.16.253.2 icmp: echo request
   2: 23:46:07.541842       172.16.253.2 > 172.16.1.10 icmp: echo reply 
   3: 23:46:08.534075       172.16.1.10 > 172.16.253.2 icmp: echo request
   4: 23:46:08.540621       172.16.253.2 > 172.16.1.10 icmp: echo reply
   5: 23:46:09.773031       172.16.1.10 > 10.10.253.2 icmp: echo request
   6: 23:46:09.780034       10.10.253.2 > 172.16.1.10 icmp: echo reply 
   7: 23:46:10.773946       172.16.1.10 > 10.10.253.2 icmp: echo request
   8: 23:46:10.778569       10.10.253.2 > 172.16.1.10 icmp: echo reply

4.恢復通過外部介面的路徑，重新建立到RTR1的PPPoE會話。通過outside2介面的會話將轉換到掛起的重複使用狀態:

firewall# show vpdn session pppoe state

PPPoE Session Information (Total tunnels=1 sessions=1)

SessID TunID Intf     State       Last Chg
   17      3 outside  SESSION_UP  89 secs

firewall# show vpdn pppinterface       
PPP virtual interface id = 1
PPP authentication protocol is PAP
Server ip address is 10.10.1.1
Our ip address is 10.10.1.10
Transmitted Pkts: 58, Received Pkts: 58, Error Pkts: 0
MPPE key strength is None
  MPPE_Encrypt_Pkts: 0,  MPPE_Encrypt_Bytes: 0
  MPPE_Decrypt_Pkts: 0,  MPPE_Decrypt_Bytes: 0
  Rcvd_Out_Of_Seq_MPPE_Pkts: 0

PPP virtual interface id = 2 was deleted and pending reuse


firewall# show route
...

S*       0.0.0.0 0.0.0.0 [1/0] via 10.10.1.1, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.1 255.255.255.255 is directly connected, inside

系統日誌：

Mar 15 2026 00:04:36: %ASA-4-411001: Line protocol on Interface GigabitEthernet0/0, changed state to up
Mar 15 2026 00:05:27: %ASA-6-603108: Built PPPOE Tunnel, tunnel_id = 3, remote_peer_ip = 10.10.1.1, ppp_virtual_interface_id = 1, client_dynamic_ip = 10.10.1.10, username = pppoe
Mar 15 2026 00:05:35: %ASA-6-622001: Adding tracked route 0.0.0.0 0.0.0.0 10.10.1.1, distance 1, table default, on interface outside
Mar 15 2026 00:05:35: %ASA-6-603109: Teardown PPPOE Tunnel, tunnel_id = 4, remote_peer_ip = 172.16.1.1
Mar 15 2026 00:05:40: %ASA-6-622001: Removing tracked route 172.16.253.0 255.255.255.0 172.16.1.1, distance 1, table default, on interface outside2
Mar 15 2026 00:05:40: %ASA-6-317078: Deleted STATIC route 172.16.253.0 255.255.255.0 via 172.16.1.1 [1/0] on [outside2] [Gi0/1] tableid [0]

5.從PC IP地址192.168.1.2到10.10.253.2和172.16.253.2的資料包通過outside interface（主路徑）傳送，此外，由於PAT，capture capo顯示輸出介面IP地址（對映地址）：

Mar 15 2026 00:17:27: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2685 to outside:10.10.1.10/2685
Mar 15 2026 00:17:29: %ASA-6-305011: Built dynamic ICMP translation from inside:192.168.1.2/2686 to outside:10.10.1.10/2686


firewall# show capture
capture capo type raw-data interface outside [Capturing - 912 bytes]
  match icmp any host 10.10.253.2
  match icmp any host 172.16.253.2
capture capo2 type raw-data interface outside2 [Capturing - 0 bytes]
  match icmp any host 172.16.253.2
  match icmp any host 10.10.253.2

firewall# show capture  capo
8 packets captured

   1: 00:17:27.680247       10.10.1.10 > 10.10.253.2 icmp: echo request
   2: 00:17:27.688761       10.10.253.2 > 10.10.1.10 icmp: echo reply
   3: 00:17:28.680415       10.10.1.10 > 10.10.253.2 icmp: echo request
   4: 00:17:28.683405       10.10.253.2 > 10.10.1.10 icmp: echo reply
   5: 00:17:29.732673       10.10.1.10 > 172.16.253.2 icmp: echo request 
   6: 00:17:29.739799       172.16.253.2 > 10.10.1.10 icmp: echo reply
   7: 00:17:30.732979       10.10.1.10 > 172.16.253.2 icmp: echo request
   8: 00:17:30.736656       172.16.253.2 > 10.10.1.10 icmp: echo reply

8 packets shown

附註：

路由更改不會應用於現有連線。因此，即使有更好的路徑可用，現有連線仍繼續使用「舊」路徑。實際上，這可能在路由更改後造成影響。要指示防火牆使用新路徑，請考慮啟用浮動連線計時器。如果啟用了浮動連線超時（設定為非零值），則如果有更好的路由可用，則此超時允許連線關閉，以便可以重新建立連線以使用更好的路由。請參閱https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/T-Z/asa-command-ref-T-Z/m_ta-tk.html中浮接頭的說明。

如何使用FlexConfig刪除或否定部署的命令？

如果要移除或否定由FlexConfig部署的配置，則必須執行以下步驟：

按以下順序使用否定命令建立FlexConfig，並確保將Type設定為Prepend:

刪除對跟蹤對象的引用
刪除跟蹤對象
刪除SLA對象

通過負載共用和PPPoE客戶端路由跟蹤刪除為主動 — 主動冗餘部署的配置的示例：

Flexonfig removal 1 Flexonfig移除1

刪除為無負載共用的主用 — 備用冗餘部署的配置的示例：

Flexonfig removal 2 Flexonfig移除2

2.將在步驟1中建立的否定對象新增到FlexConfig策略中。確保用於新增PPPoE命令的對象已刪除，並且不在策略中：

FlexConfig Removal Policy FlexConfig刪除策略

3.在CLI中部署策略並驗證命令的刪除。

4.從FlexConfig策略中刪除在第1步建立的否定對象並重新部署。

參考資料

思科錯誤ID CSCwt39430 「ENH:在FMC UI上支援FTD介面DHCP/PPPoE客戶端配置命令和子命令」

修訂記錄

修訂	發佈日期	意見
1.0	17-Mar-2026	初始版本

由思科工程師貢獻

伊爾金·加西莫夫
Cisco TAC工程師
奧列格·提皮索夫
Cisco TAC工程師

這份文件是否有所幫助？

意見

讓思科協助您

開啟支援問題單
(需有思科服務合約)

配置和驗證ASA/FTD中的PPPoE冗餘/高可用性

無偏見用語

關於此翻譯

目錄

簡介

必要條件

需求

採用元件

背景資訊

具有負載共用的主動備援

ASA配置

FTD組態

帶有負載共用和PPPoE客戶端路由跟蹤的主用 — 主用冗餘

ASA配置

FTD組態

無負載共用的主備冗餘

ASA配置

FTD組態

如何使用FlexConfig刪除或否定部署的命令？

參考資料

修訂記錄

由思科工程師貢獻

這份文件是否有所幫助？

讓思科協助您

本文件適用於這些產品