ASA虚拟防火墙配置问题

szmabcd

如上图所示，当只启用一台ASA时，并配置虚拟防火墙，在context中写相应的路由，PC均能PING通1.1.1.1

但是当启用两ASA后，PC无法ping通1.1.1.1，防火墙到PC也无法ping通，求解，谢谢！


ciscoasa# show run
: Saved
:
ASA Version 8.0(2) <system>
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
no mac-address auto
!
interface Ethernet0/0
!
interface Ethernet0/0.3
vlan 3
!
interface Ethernet0/0.4
vlan 4
!
interface Ethernet0/1
!
interface Ethernet0/1.2
vlan 2
!
interface Ethernet0/1.5
vlan 5
!
interface Ethernet0/2
description LAN Failover Interface
!
interface Ethernet0/3
description STATE Failover Interface
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
class default
  limit-resource All 0
  limit-resource ASDM 5
  limit-resource SSH 5
  limit-resource Telnet 5
!

ftp mode passive
pager lines 24
failover
failover lan unit primary
failover lan interface FAILOVER Ethernet0/2
failover link STATE Ethernet0/3
failover interface ip FAILOVER 1.1.1.1 255.255.255.0 standby 1.1.1.2
failover interface ip STATE 2.2.2.1 255.255.255.0 standby 2.2.2.2
failover group 1
  preempt
failover group 2
  secondary
  preempt
no asdm history enable
arp timeout 14400
console timeout 0

admin-context Admin
context Admin
  config-url disk0:/Admin.cfg
!

context A
  allocate-interface Ethernet0/0.3
  allocate-interface Ethernet0/1.5
  config-url disk0:/A.cfg
  join-failover-group 1
!

context B
  allocate-interface Ethernet0/0.4
  allocate-interface Ethernet0/1.2
  config-url disk0:/B.cfg
  join-failover-group 2
!

prompt hostname context
Cryptochecksum:00000000000000000000000000000000
: end
ciscoasa# show
INFO: % Type "show ?" for a list of subcommands
ciscoasa# cahn
ciscoasa# chan
ciscoasa# changeto con
ciscoasa# changeto context A
ciscoasa/A# show run
: Saved
:
ASA Version 8.0(2) <context>
!
hostname A
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0.3
nameif inside1
security-level 100
ip address 172.16.1.1 255.255.255.0 standby 172.16.1.2
!
interface Ethernet0/1.5
nameif outside1
security-level 0
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
!
passwd 2KFQnbNIdI.2KYOU encrypted
access-list OUTSIDE extended permit ip any any
pager lines 24
mtu inside1 1500
mtu outside1 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group OUTSIDE in interface outside1
route outside1 1.1.1.0 255.255.255.0 192.168.1.10 1
route outside1 1.1.1.0 255.255.255.0 192.168.2.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_2
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns migrated_dns_map_2
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
Cryptochecksum:00000000000000000000000000000000
: end
ciscoasa/A#    chan
ciscoasa/A#    changeto con
ciscoasa/A#    changeto context B
ciscoasa/B# SHOW RUN
: Saved
:
ASA Version 8.0(2) <context>
!
hostname B
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0.4
nameif inside2
security-level 100
ip address 172.16.2.1 255.255.255.0 standby 172.16.2.2
!
interface Ethernet0/1.2
nameif outside2
security-level 0
ip address 192.168.2.1 255.255.255.0 standby 192.168.2.2
!
passwd 2KFQnbNIdI.2KYOU encrypted
access-list OUTSIDE extended permit ip any any
pager lines 24
mtu inside2 1500
mtu outside2 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group OUTSIDE in interface outside2
route outside2 1.1.1.0 255.255.255.0 192.168.2.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_3
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns migrated_dns_map_3
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
Cryptochecksum:00000000000000000000000000000000
: end
ciscoasa/B#
ciscoasa/B#
ciscoasa/B#



ciscoasa# show failover state

               State          Last Failure Reason      Date/Time
This host  -   Primary
    Group 1    Active         None
    Group 2    Standby Ready  None
Other host -   Secondary
    Group 1    Standby Ready  None
    Group 2    Active         None

====Configuration State===
        Sync Done
====Communication State===
        Mac set

ydministrator

szmabcd

有没有人会啊，来人啊，真是的