Hướng dẫn cấu hình ASA Cisco chạy 2 line PPPOE chính và dự phòng

Mô hình:

Thiết bị ASA của Cisco không hỗ trợ cân bằng tải đường truyền internet nên trong trường hợp này chúng ta sẽ cấu hình 1 đường ISP1 làm đường chính và đường ISP2 làm đường dự phòng.

Cấu hình vpdn khai báo các group PPPOE, account của từng ISP (cấu hình Cisco ASA quay PPPOE):

vpdn group ISP-1-PPPOE request dialout pppoe
vpdn group ISP-1-PPPOE localname username_isp_1
vpdn group ISP-1-PPPOE ppp authentication pap
vpdn group ISP-2-PPPOE request dialout pppoe
vpdn group ISP-2-PPPOE localname username_isp_2
vpdn group ISP-2-PPPOE ppp authentication pap
vpdn username username_isp_1 password ***** store-local
vpdn username username_isp_2 password ***** store-local

Cấu hình track và sla để thiết bị theo dõi đường truyền chính ISP1. Nếu đường chính fail sẽ remove khỏi bảng route để chạy đường ISP2.

sla monitor 123
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
 num-packets 3
 frequency 120
sla monitor schedule 123 life forever start-time now
!
track 123 rtr 123 reachability

Áp group PPPOE và track vào các interface WAN tương ứng. Đường ISP2 làm dự phòng nên sẽ để distance cho route cao hơn đường ISP1

interface GigabitEthernet1/1
 description "ISP-1"
 nameif outside
 security-level 0
 pppoe client vpdn group ISP-1-PPPOE
 pppoe client route track 123
 ip address pppoe setroute
!
interface GigabitEthernet1/2
 description "ISP-2"
 nameif backup
 security-level 0
 pppoe client vpdn group ISP-2-PPPOE
 pppoe client route distance 254
 ip address pppoe setroute
!
interface GigabitEthernet1/3
 description "LAN-LOCAL"
 nameif inside
 security-level 100
 ip address 192.168.100.1 255.255.255.0

Cấu hình NAT dải network LAN ra 2 đường ISP:

object network Inside
 subnet 0.0.0.0 0.0.0.0
 nat (inside,outside) dynamic interface
object network inside
 subnet 0.0.0.0 0.0.0.0
 nat (inside,backup) dynamic interface

Như vậy là các Client đã có thể truy cập internet qua đường chính ISP1. Khi thiết bị check ping ra inernet (8.8.8.8) qua ISP1 thấy time out thì dữ liệu sẽ được đẩy qua đường ISP2 ra ngoài internet. Khi đường chính ISP1 có lại dữ liệu sẽ lại được đẩy qua ISP1 ra ngoài.

Cấu hình đầy đủ:

: Hardware:   ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
:
ASA Version 9.8(2)
!
hostname ASA5516
enable password $sha512$5000$g1ei/CvjQueNE+jj/SEOeg==$/Wfh3Au1Fsr/aauthRJoOw== pbkdf2
names

!
interface GigabitEthernet1/1
 description "ISP-1"
 nameif outside
 security-level 0
 pppoe client vpdn group ISP-1-PPPOE
 pppoe client route track 123
 ip address pppoe setroute
!
interface GigabitEthernet1/2
 description "ISP-2"
 nameif backup
 security-level 0
 pppoe client vpdn group ISP-2-PPPOE
 pppoe client route distance 254
 ip address pppoe setroute
!
interface GigabitEthernet1/3
 description "LAN-LOCAL"
 nameif inside
 security-level 100
 ip address 192.168.100.1 255.255.255.0
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network Inside
 subnet 0.0.0.0 0.0.0.0
 nat (inside,outside) dynamic interface
object network inside
 subnet 0.0.0.0 0.0.0.0
 nat (inside,backup) dynamic interface
pager lines 24
logging asdm informational
mtu outside 1492
mtu backup 1492
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network Inside
 nat (inside,outside) dynamic interface
object network inside
 nat (inside,backup) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication telnet console LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
sla monitor 123
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
 num-packets 3
 frequency 120
sla monitor schedule 123 life forever start-time now
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
!
track 123 rtr 123 reachability
!
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 30
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 60
vpdn group ISP-1-PPPOE request dialout pppoe
vpdn group ISP-1-PPPOE localname username_isp_1
vpdn group ISP-1-PPPOE ppp authentication pap
vpdn group ISP-2-PPPOE request dialout pppoe
vpdn group ISP-2-PPPOE localname username_isp_2
vpdn group ISP-2-PPPOE ppp authentication pap
vpdn username username_isp_1 password ***** store-local
vpdn username username_isp_2 password ***** store-local
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
username admin password $sha512$5000$2SXAryRDR9/ObcfqRXIEWw==$cFf5TON0JMJxgsxBx3E84A== pbkdf2 privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:e6cd758bffadd08bcfc46ecccbdcea76
: end

Chúc các bạn thành công!