ASR ZBFW Config sync between routers?

I have been reading about, and will try to set up, Firewall Stateful Interchassis Redundancy for my edge ASR-1002-X routers. I have found the Config guide for that feature here and one of the prereqs is "The active device and the standby device must have the same Cisco IOS XE Zone-Based Firewall configuration," which makes sense.
What I can't find is how to keep the ZBFW config "in sync" between the routers.
I am assuming there is an automated way to do this, a la the ASA failover pair configuration sync process (a loose example, I grant), but I cannot find how to automate the sync. I am hoping this can be done for ONLY the ZBFW config, as the routers have different BGP configs, etc.
If there is not, does anyone know what happens while one is making changes to the ZBFW config on one or the other routers? Does this break the state sync?
Thanks for any help.
Paul

Hello Karien,
Not sure I get the question..
The definition you are looking I guess is this one:
A router can only inspect inter-VRF traffic if traffic must enter or leave a VRF through an interface to cross to a different VRF. If traffic is routed directly to another VRF, there is no physical interface where a firewall policy can inspect traffic, so the router is unable to apply inspection.
Based on that I would say that on each VRF there will need to be a dedicated security zone applied,
I will try to run a lab real quick tomorrow and get back to u,
Remember to rate all of the helpful posts. That's as important as a Thanks.
Julio Carvajal Segura

Similar Messages

Problem with config sync between two CSM-S modules

Hi everybody,
I have a problem with config sync between two CSM-S modules.
I am using CSM-S software version 2.1(8).
The acitve module is used in a 6509 with WS-SUP720-BASE supervisor running software version 12.2(18)SXF12a.
The standby module is used in a 6509-V with VS-S720-10G supervisor (no VSS setup) running software version 12.2(33)SXI3.
Failover seems to work fine:
switch-active#sh modu csm 2 ft
FT group 1, vlan 398
This box is active
Configuration is out-of-sync
priority 150, heartbeat 3, failover 40, preemption is on
switch-standby# sh modu csm 2 ft
FT group 1, vlan 398
This box is in standby state
Configuration is out-of-sync
priority 80, heartbeat 3, failover 40, preemption is on
The command (on active side) "hw-module contentSwitchingModule 2 standby config-sync" leads to following result:
switch-active:
2010-04-14T16:21:45+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56042: Apr 14 16:21:44.223: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Active: Bulk sync started
2010-04-14T16:21:45+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56043: Apr 14 16:21:44.251: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Active: Sending configurations to Standby CSM, this may take several minutes!
2010-04-14T16:21:46+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56044: Apr 14 16:21:45.995: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Active: Sending configuration to Standby CSM
2010-04-14T16:21:51+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56045: Apr 14 16:21:50.831: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Active: Sending configuration to Standby CSM
2010-04-14T16:21:57+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56046: Apr 14 16:21:56.151: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Active: Sending configuration to Standby CSM
2010-04-14T16:22:59+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56047: Apr 14 16:22:58.791: %CSM_SLB-3-REDUNDANCY: Module 2 FT error: Active: Manual bulk sync timed out
2010-04-14T16:22:59+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56048: Apr 14 16:22:58.803: %CSM_SLB-3-REDUNDANCY: Module 2 FT error:
2010-04-14T16:22:59+02:00 srz16-1b.net.dsh.at/srz16-1b.net.dsh.at 56049: FT CONFIG SYNC: Failed config sync entity send
switch-standby:
2010-04-14T16:21:45+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2475: Apr 14 16:21:44.232: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Standby: Bulk sync started
2010-04-14T16:21:45+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2476:
2010-04-14T16:21:45+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2477: Apr 14 16:21:44.240: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: STANDBY:Configuration is being received, This may take several minutes!
2010-04-14T16:21:49+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2478: Apr 14 16:21:48.824: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Standby: Receiving configuration from Active CSM
2010-04-14T16:21:54+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2479: Apr 14 16:21:53.964: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Standby: Receiving configuration from Active CSM
2010-04-14T16:21:59+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2480: Apr 14 16:21:58.852: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Standby: Started clearing configuration
2010-04-14T16:21:59+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2481: Apr 14 16:21:59.400: %CSM_SLB-4-REDUNDANCY_WARN: Module 2 FT warning: Standby: Config Sync does not save running-config to startup-config
2010-04-14T16:22:00+02:00 srz31-5a.net.dsh.at/srz31-5a.net.dsh.at 2482: Apr 14 16:21:59.400: %CSM_SLB-6-REDUNDANCY_INFO: Module 2 FT info: Standby: Previous configuration are being deleted from supervisor
The last log message on standby device seems to be correct - there is no CSM configuration after the attempted config sync.
Our configuration includes about 3500 lines and it is really uncomfortable to keep in sync manually.
Maybe someone has the same problem?
kind regards,
Christoph

Hi Christoph,
I am running into the exact same issue. Upon further investigation I've discovered that this is a known bug, CSCtd09117. You can read more about it here: http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtd09117 . Apparently this is fixed in ver 12.2(32.8.11)SX323 .
I haven't had a chance to upgrade yet, so I can't verify the fix, but if it works for you please let me know.
Regards,
Brandon

ACE Switchover and Config Sync

Hi
I'm new to the ACE modul and trying to set up some szenarios and i run already into some troubles.
Question 1)
I configured redundancy to another module - virtulised mode. Config sync between the context worked fine. If i change s'thing in the activ context it was copied to the standby context. But if i changed something in the active Admin context it was not copied to the standby Admin context.
Question 2)
FT Switchover in the Admin context is not possible returns the following fault:
ACE_Switch08/Admin# ft switchover
This command will cause card to switchover (yes/no)? [no] yes
Invalid FT group. FT switchover command will be ignored.
ACE_Switch08/Admin#
If I switch a single FT group it works. But how is it possible to switch all FT groups a the same time? Do i have to switch each context by itself?
Question 3)
After i have switched the active context to the standby context, the ft group x command shows both peers as active. After i take the standby ft group no inservice and back inservice it shows correctly Active and standby_HOT.
The configuration:
hostname ACE_Switch08
boot system image:c6ace-t1k9-mz.3.0.0_A1_4a.bin
resource-class RC1
limit-resource all minimum 10.00 maximum equal-to-min
class-map type management match-any REMOTE_ACCESS
description -- Remote Access traffic match --
2 match protocol telnet any
3 match protocol ssh any
4 match protocol icmp any
policy-map type management first-match REMOTE_MGMT_ALLOW_POLICY
class REMOTE_ACCESS
permit
interface vlan 2100
ip address 172.29.190.16 255.255.255.0
service-policy input REMOTE_MGMT_ALLOW_POLICY
no shutdown
ft interface vlan 2020
ip address 192.168.100.1 255.255.255.0
peer ip address 192.168.100.2 255.255.255.0
no shutdown
ft peer 1
heartbeat interval 200
heartbeat count 20
ft-interface vlan 2020
ip route 0.0.0.0 0.0.0.0 172.29.190.1
context sf0-2200
allocate-interface vlan 2201
allocate-interface vlan 2207
member RC1
context sf0-2220
allocate-interface vlan 2221
allocate-interface vlan 2227
member RC1
ft group 1
peer 1
no preempt
priority 200
peer priority 150
associate-context sf0-2200
inservice
ft group 2
peer 1
no preempt
priority 200
peer priority 150
associate-context sf0-2220
inservice
username admin password xxx role Admin domain
default-domain
username www password xxx role Admin domain de
fault-domain
Any help is appreciated
pat

Hi Pat,
1)
for my config i just put the "user" or "backend" contexts into ft groups. I don't sync the admin contexts on both aces. I am not even sure if that makes sense or is "best practicse".
So if you don't put the admin context into an extra ft group it won't be synced. you have to configure the admin contexts on each physical ace separately.
Putting the contexts sf0-2200 & sf0-2220 into an ft group and not having an ft group for admin is the way to go IMHO.
2)
If you do a switchover you always have to specify which context you want to switchover. I don't think that you can actually switchover a whole bunch of contexts with this command. If you want to do that a reload is the only way AFAIK.
Try:
ft switchover 1
ft switchover 2
3)
This could be because you have not configured the other ACE's admin context to participate in the ft properly.
My configs looke like this.
ACE01:
ft interface vlan 777
ip address 172.16.99.1 255.255.255.252
peer ip address 172.16.99.2 255.255.255.252
no shutdown
ft peer 1
heartbeat interval 200
heartbeat count 20
ft-interface vlan 777
query-interface vlan 444
ft group 3
peer 1
priority 150
peer priority 110
associate-context FOO
inservice
ft group 4
peer 1
priority 150
peer priority 110
associate-context BAR
inservice
ft group 2
peer 1
priority 150
peer priority 110
associate-context FOO-BAR
inservice
ACE02:
ft interface vlan 777
ip address 172.16.99.2 255.255.255.252
peer ip address 172.16.99.1 255.255.255.252
no shutdown
ft peer 1
heartbeat interval 200
heartbeat count 20
ft-interface vlan 777
query-interface vlan 444
ft group 2
peer 1
no preempt
priority 110
peer priority 150
associate-context FOO
inservice
ft group 3
peer 1
no preempt
priority 110
peer priority 150
associate-context BAR
inservice
ft group 4
peer 1
no preempt
priority 110
peer priority 150
associate-context FOO-BAR
inservice
Hope that helps
Roble

I have a problem with the sync between iTunes and ipad2. I can not see the files in iPad. Help me please.

I have a problem with the sync between iTunes and ipad2. I can not see the files in iPad. Help me please.

Cannot see what files ? Music (synced music should appear in the iPod app), films/TV shows (Videos app), documents ... ?

ICloud doesn't sync between mac and iPhone...

Hello all. I have an iphone 4 and I macbook pro which I have just upgraded the OS to OSX Mountain lion.
I have never really made use of icloud before, but intend to start using it as I intend to get an ipad soon.
I have gone into icloud on both my mac and iphone and ticked on everything for icloud. However,nothing seems to really sync. My notes don't go between devices. As far as I can tell neither do my photos.
The only large file on my icloud seems to be backups. However, the only thing in this folder seems to be the back up folder...which only seems to contain infinitiy blade data.
Any help as to where I'm going wrong?
regards,
Matt

I don't want to trust the iCloud, so I want to sync my PERSONAL Notes on my iPhone (4) just with my iMAC (via iTunes), and not saved in iCloud.
Yes iCloud is great for syncing/saving common data, but I want to choose what I sync and if I choose not to save in icloud than I want to have the possibility to save it elsewhere.
Now with Mountain Lion it is not possible anymore to sync between my iPhone and iMac
More and more companies are going to say/dictate "This and this is good for you!"
Please Apple, take your Customers serious and let themselve choose what good for them is!
Thanks in advance!!
P.S.,
if there Apple-Customers who have a solution for syncing Notes between MountainLion and iOS please reply! (Thanks)

Pages won't sync between iPad and Macbook

I cannot get my pages to sync between iPad and Macbook.
I regularly go back and forth between the two because it's easier to read/edit on iPad and easier to type/copy-paste web info on Macbook.
I'm finding right now that I have done a multitude of edits on my iPad that are not showing up at all when I open the same document on my Macbook.
I have closed the document on my iPad so I expected there to be no problems when I opened it on my Macbook.
Not sure why or what to do....?

I had this issue too - I have been playing around with it for a few days - turns out you need to save the documents on your mac not under "documents" but rather under "Pages - iCloud" (or "Keynote - iCloud" etc.). After doing this, the document appears on my phone, iPad, iCloud.com etc. with the changes.
One way to do this is by clicking the dropdown arrow (it shows up when you mouse over the title) to the right of the title of your document on the grey title bar (the thing at the top of the page - above insert, table, chart etc.) and then editing the "where" column.
Hope this helps! If it isn't clear enough, please let me know!

I have 2 itunes accounts. I can no longer use my first one for purchases so I had to start a new one and it will not sync from my new one without deleting everything on my same ipod from my previous account. How do I sync between both accounts?

I have 2 itunes accounts. I can no longer use my first one for purchases so I had to start a new one and it will not sync from my new one without deleting everything on my same ipod from my previous account. How do I sync between both accounts?

Wayland wrote:
The CS.com service account has long been closed. I cannot get it to respond to my years ago password for that account. So I ask them to send me a new password and of course it goes to my years ago email number.
Don't have it send email.
Answer the security questions.

I have activated 2 iPhones using my iTunes account, but I now would like to take one iPhone off this account, and start its own iTunes "pairing" in order to back up, without cross syncing between purchases, how can I do this?

I have activated 2 iPhones using ONE iTunes account, but I would now like to remove one iPhone from the account and add it to a new iTunes account. This is so that I can back it up without cross syncing between purchases/apps on both iPhones.
Whats the best method for this?
I'm running Windows 7
Many thanks

Whenever a menu choice is grayed out, that is because you have Restrictions turned on in Settings. Be sure to turn it off.
You are confusing an itunes store account with an icloud account. You two can continue using the same ID for itunes (thus sharing purchased music, apps, etc.), but you really should have separate accounts (different IDs) for icloud, since an account is intended for one user to keep his/her devices in sync.
To create a new icloud account, go to
http://www.apple.com/icloud/setup/
Then go to Settings>icloud and scroll to the bottom of the screen and tap Delete Account. (have restrictions turned off) That will disconnect the device from the account but will not delete data in icloud or other devices. Then sign in using the new ID.

How do I get iCloud to sync between "Day One" app on iPhone and Macbook Pro

I Just recently got my Macbook Pro up to date. I am working on setting up iCloud and I have succesfully backed up my information, but I can't figure out how to sync between my Mac application and iPhone application "Day One". Hope you can help me.

Try here > iCloud: Troubleshooting iCloud Reminders and Tasks

How do I stop the EMAIL sync between my desktop and my laptop?

How do I stop the email sync between my desktop computer and my laptop? Right now, the laptop is set to automatically load my email when I click on mail. I use my desktop daily; laptop only when traveling. The laptop is somehow set to receive ALL messages, so I get messages that are several weeks/months old. I want to be able to manually sync and NOT have all of the hundreds of old, already viewed messages sent to my laptop. However, I DO want my desktop to receive all of my old messages so that I can have them when I return from traveling. Thanks.

Actually, your mail isn't 'synchronizing' in the conventional sense at all. And, you are effectively trying to make it do so manually at the present time. As you have discovered, this simply does not work.
The only way that you can effectively address your requirements is to use IMAP—rather than POP3—technology. Using IMAP will allow you to readily control what is stored on the server, and will provide a view into that data store when you use your portable computer.
While is is possible to use POP3 and set one computer to delete mail from the server and the other not to, this is potentially fraught with problems, and will not fully address your concerns.
An IMAP option is available from such providers as Apple with .Mac, AOL with AOL Mail and AIM Mail, and Google with GMail. You can convert an existing POP3 account with such a provider to IMAP with little difficulty, or initiate a new IMAP account with such a provider and forward mail to it from providers who do not offer such an option.

My ipad has stopped syncing my calendar. Both iPhone and ipad. After going to the setting - mail, contacts,calendar my Ipad has no where under the calendar category for default calendar. How can I get my calendar to sync between iPhone and ipad???

Up until recently my calendar were syncing (between my iPhone 4 & ipad mini). They are no longer synching. I have searched and everything matches to all the resolutions, the problem is on my ipad under Calendars in the settings there is no option for "default calendar". Every other option matches to what is on my phone, just the default calendar option is missing. The default email is the same for both. Help!!!!
Thank you
Penelope190

An interesting additional symtom is that items loaded in the PC (which immedialely duplicate to the iCloud calendar on eht PC - no worries, there) do not transpose the devices (as above) but, loading an item into the phone, it goes to the PC (which is fine, too). But not to the iPad. Interestingly, there fewer calendar display options on the iPad than on the phone.
I talked to Apple a few months ago (after ISO 5) - mainly about the 6000 plus addresses that suddenly appeared in my Contacts - and his advice was do all contact and calendar actions on the PC. "icloud is still faulty"
So there we are! I must have items and reminders in my PC - it is my main work station - and need them on my devices to avoid conflicts when away from my office.

ICloud mail sync between iPhone 4S and Mac Book

I am new in the Apple world. I have a brand new Apple MacBook Pro right out of the box and an older iPhone 4S, using a Pop3 mail account (and for various reasons I do NOT want to change to IMAP, e.g. storage space issues on the server). I do not use Gmail or any other of these services, but use my own e-mail via my website provider. I download e-mails via POP3 onto various computers (but leaving e-mails on the server for a period of 4 weeks).
I can send and receive e-mails, no problem on my Mac nor my iPhone.
To sync between both (esp. with regard to sent mails) I have created an icloud account which works fine for synchronising my contacts, for example. But it does not in any way synchronise my e-mails between the devices or show any e-mails in icloud mail (in icloud or on in Mac mail) at all. The folder is there, it's just empty.
I changed over from Windows after being frustrated by performance issues (although I am starting to miss Outlook already). But in the Apple world I am already overwhelmed by the feeling that I do not have the slightest idea of how to set up things here...I am aware that I might not get the simplest basics, but I have no one to ask (since all friends are Microsofts-addicts).
I use three e-mails accounts (work and private) and now I am already stuck with getting to run one and sync it over the devices, let alone three.
Thanks for any help!
Stephanie

Apparently you must be very narrow minded. I don't want to develop an e-mail client from the scratch.
I would implement the sync the following way.
Assuming I use POP3 on both my iPhone and my MacBook. On my iPhone mail client I am downloading e-mails and reading them from time to time and replying. There is an ended set of what you actions you can do with your e-mails. Every e-mail has a unique ID / fingerprint - you can recognize it with 100% accuracy. I'm also downloading e-mails on my MacBook mac mail and performe the same ended set of actions on this e-mails. So the system architecture should be as follows:
1. MacBook mail client queues all the actions I have performed with my e-mails on my MacBook.
2. iPhone mail client does the same - creates a queues with actions I have performed on my iPhone.
3. If I have the syncing turned on on both of my devices and I'm logged in on both of them with the same Apple ID both devices process the queues to my iCloud, compare it and update status of my e-mails according to the actions in each queue.
So I will rather wait until Apple will do this simple solution.

How do you make the actually open safari iCloud tabs sync between iMac and iPad?

I'm trying to have it so the web browser tabs I actually have open and viewing at any time, are synced between my iMac and my iPad.
This doesn't appear to work via iCloud Safari tabs, you just get the tabs open on your iMac as a list you can access on the iPad if you go digging through options.
Any help would be very much appreciated!

Hello JordanCS88,
Thank you for using Apple Support Communities.
The following article provides information for troubleshooting Calendar syncing. For your issues on your Macbook, see the section "Troubleshooting on OS X".
iCloud: Troubleshooting iCloud Calendar - Apple Support
Regards,
Jeff D.

Can I backup two devices (with different documents) to one iCloud account? For example: iPad and iPhone, not everything is synced between the two, but I would like to backup each (seperately in the cloud), is this possible?

Hello Apple Community,
Can I backup two devices (with different documents) to one iCloud account?
For example: iPad Air and iPhone 5, not everything is synced between the two, but I would like to backup each (seperately in the cloud). Is this possible?
This way when I change from an old ipad to a new, I can restore with the ipad backup, and when I change from an old iphone to a new, I can restore from the
iphone backup.
Thank you in advance!

Terminology check here. Do you really mean a "CD"? There's a difference in Cloud behavior between content from a physical CD you ripped (which only has Cloud content if you have iTunes Match) and an "album" you bought from the iTunes Store.
Read references for Home Sharing.
iTunes: How to share music and video - http://support.apple.com/kb/HT2688 - about Music Sharing and Home Sharing
Home Sharing Support page - http://www.apple.com/support/homesharing/
iOS: Setting up Home Sharing on your device - http://support.apple.com/kb/ht4557 - "With Home Sharing in iOS 4.3 or later, you can stream your entire iTunes library over your home Wi-Fi network from your Mac or PC right to your iPhone, iPad, or iPod touch."
The above can get pretty complicated. You are probably best off by syncing both devices to a single library and/or updating the libraries on both computers to have the same content.

Sync between MacBookPro and iPhone 3G does not sync properly. Calendars duplicate events but worse is that only contacts from Address book from letter T onwards sync. Any contacts on iPhone which are not on Mac are lost during sync.

Sync between MacBookPro and iPhone 3G does not sync properly. Calendars duplicate events but worse is that only contacts from Address book from letter T onwards sync. Any contacts on iPhone which are not on Mac are lost during sync.
Solutions?

No, I never really found an easy solution. I believe it is an issue with some corruption in the iTunes database on the specific device. In my case, both my iPad and iPhone now show duplicate stream songs if viewed through iTunes on my Mac, but they show different songs. A couple years ago I had a similar issue on my iPhone, and Apple support suggested I back up the phone, completely reset it, and then restore it from the backup. It did work, so I imagine it would probably work for my current issues with the iPhone and iPad. But resetting and restoring an iPad or iPhone always makes me a little nervous that something will get lost. When I did reset/restore the iPhone, I do have to say, the restore process was 100% perfect and I did not lose any data at all even though Apple support said I might. If you try to go that route, I would suggest backing the device up both to a computer through iTunes, and to the iCloud so that you have a double backup.
None of this really resolves the issue with how the iTunes databases are becoming corrupted on the apple devices though, so it is very likely to happen again until they fix it. I have been unable to determine if there were any specific actions or conditions which caused the corruption to happen in the first place.
Might be worth another call to Apple support, or dropping in the local Apple store if you have one near by.

ASR ZBFW Config sync between routers?

Similar Messages

Maybe you are looking for