SLA monitoring is finally here. What is it useful for ? To add/remove dynamically routes in ASA depending on results of the SLA status.
Below is configuration steps but while there are many words in the command itself there are not much options there , so the command is long but pretty uniform.

Now create tracking process to be later applied to the static route:

And finally we create static route and attach to it the created track :

Now let’s see some statistics on the track:

The final configuration looks like

And by the way it really works – when track is down the route to which it is attached magically disappeared
from the routing table as should.

Time is precious, even more when you need accurate logging to know when someone breaks into your systems. Let’s configure NTP time synchronization on our ASA 5510.
Configs are pretty simple, but worth remembering a thing or two.

• ASA can not be NTP server as opposed to IOS.
• You can use prefer optional keyword with ntp server command but … it works if you have multiple servers having “the same accuracy” by Cisco.com words. In people’s language they mean the same stratum. If your ASA has 2 servers – one of stratum 2 and other of stratum 3 , even if you put stratum 3 server as preferred the one of stratum 2 will be selected.
• Authentication is available but oprional. The only algorithm of choice is MD5.
• You can have multiple trusted keys at the same time, I guess they will be tried in turn (needs verification).

Ok then, back to CLI – NTP server is 153.6.3.3, use authentication, MD5.

Some debug comes next :

In Checkpoint they call it interface bonding – when will I stop dragging this Checkpoint everywhere ? – in Cisco ASA they called it interface redundancy. The idea is to provide for the physical link failure. That is – you combine two physical interfaces on the ASA into a virtual one, then you configure all the Layer 3 parameters on this virtual interface. At the same time only ONE of the interfaces in a group is active, if it fails ASA transparently switches to the next available interface in a group and all traffic passes through it. By default the first added to the group interface becomes active and all the rest become passive. At the end of the article there is some dry theory and facts, but now let’s plunge into code.
Warning !The moment you assign some physical interface to be a member of the redundant virtual interface ALL the existing configs on such interface are wiped out.
Create redundant interface (group) and assign 2 physical interfaces to it :

Now basically we can start configuring nameif , IP address and security level for this Redundant1 interface but let’s be more creative and create some VLANs on it.

So far :

Santa(config-subif)# vlan 120
Santa(config-subif)# nameif dmz
Santa(config-subif)# security-level 50
Santa(config-subif)# ip address 10.0.0.12 255.255.255.0

To remind you state of the physical interfaces comprising the Redundant 1 is :

interface Ethernet0/0
no nameif
no security-level
no ip address

interface Redundant1
member-interface Ethernet0/0
member-interface Ethernet0/2
no nameif
no security-level
no ip address

Now some verification is looming (pay attention to the bottom of the output where you can see which interface is currently active and how many state changes have happened so far) :

Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Available but not configured via nameif
MAC address 001b.d589.9892, MTU not set
IP address unassigned
1870 packets input, 150617 bytes, 0 no buffer
Received 1329 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
766 L2 decode drops
264 packets output, 24326 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max packets): hardware (9/18) software (0/0)
output queue (curr/max packets): hardware (0/2) software (0/0)
Control Point Interface States:
Interface number is 10
Interface config status is active
Interface state is active
Redundancy Information:
Member Ethernet0/0(Active), Ethernet0/2
Last switchover at 07:25:35 UTC August 19 2010

exec mode commands/options:
error errors
event events

redundant interface Redundant1 switching active from Ethernet0/2 to Ethernet0/0.

Send gratuitous ARP on Redundant1.100.
Send gratuitous ARP on Redundant1.120.
redundant interface Redundant1 switch active to Ethernet0/0 done.

Switch has happened, now verify it:

Control Point Interface States:

Interface number is 10
Interface config status is active
Interface state is active
Redundancy Information:

Member Ethernet0/0(Active), Ethernet0/2
Last switchover at 07:57:11 UTC August 19 2010

Having done a bit practice the dry theory comes next.

• You can define up to 8 Redundant interfaces (if you have ASA 5580 why not?);
• All the interfaces in the same group should be of the same type (Ethernet with Fiber won’t go well) ;
• Only one interface is passing production traffic at any given moment;
• Redundant interface gets by default MAC address of the first added to it interface, configurable;<
• When fail over happens to the second interface, it takes over MAC address of its previously active neighbour to prevent loss of traffic. If MAC is configured especially and manually it remains the same;
• You can force some interface to become Active using the command:
  Santa# redundant-interface redundant active-member <if_name>
• Redundant interfaces are compatible with fail over feature.

For even more information , see:
ASA 8.3 interface configuration

Cisco ASA and RIP
RIP has been with ASA for years and in this article I will try to cover all possible scenarios in configuring, misconfiguring. debugging and verifying it. As I come up with new ideas how to break the RIP on ASA I will update this article as well.
As it would be expected ASA has a bit limited version of RIP daemon as compared with IOS one. Major tasks you my be required to do :

• Enable RIP on the ASA;
• Dictate the version to work with – RIP v1 or RIP v2;
• Specify networks RIP protocol will be active for;
• Exclude some interfaces from active advertising RIP on them but allow to get
  RIP updates on them , i.e. passive interface(s);
• Decide whether you want auto-summarization or not. Default is on;
• Enable Rip updates authentication and whether it should be
  encrypted (MD5 mode) or clear text (text mode);
• If using authentication define authentication keys under relevant interfaces;
• To make your life harder you will be asked to redistribute;
• Finally verify and debug RIP operation.

SO let’s get our hands dirty.
Enable RIP routing process.

Set it to run exclusively version 2 . ASA doesn’t know to mix version
2 and 1 as IOS does.

Networks to be active for . You should specify classful nets or even if you specify anything different after you enter such networks ASA will automatically turn them into classful ones anyway.

Verifying configuration so far:

You will most probably want to disable summarization :

Exclude some interface from advertising on it:
– To suppress on ALL interfaces in one go:

– To be more specific:

Authentication is configured exclusively under the interface :
– Dictate which authentication mode to use.

– Specify the key (password) and its id.

Here is how it looks in show run interface :

Redistribute. Just redistributing learned in other ways networks into the RIP would be boring. As usual you redistribute connected, static, ospf and rip (when working with the rest of the protocols).

Much more interesting is to implement some policy while redistributing using route-maps. As expected route-maps here are not what we used to know in IOS.
So what can you match for me ?

The most familiar and useful match on ACL lies here:

About rest of the match conditions, I’ll cover them when talking about OSPF in ASA.

Filtering out routes in updates.
If you want to filter some networks in updates use distribute-list.

Now some debug is due.
Enable rip debug:

Normal functioning protocol debug output:

Now the authentication has been enabled but keys on 2 peers are not the same: