1-8
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Information About ASA Clustering
Note If your cluster has large amounts of asymmetric (rebalanced) traffic, then the cluster control link should
be even larger.
Cluster Control Link Redundancy
We recommend using an EtherChannel for the cluster control link, so you can pass traffic on multiple
links in the EtherChannel while still achieving redundancy.
The following diagram shows how to use an EtherChannel as a cluster control link in a Virtual Switching
System (VSS) or Virtual Port Channel (vPC) environment. All links in the EtherChannel are active.
When the switch is part of a VSS or vPC, then you can connect ASA interfaces within the same
EtherChannel to separate switches in the VSS or vPC. The switch interfaces are members of the same
EtherChannel port-channel interface, because the separate switches act like a single switch. Note that
this EtherChannel is device-local, not a Spanned EtherChannel.
Cluster Control Link Latency and Reliability
To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than
the following:
• 5 ms
To check your latency, perform a ping on the cluster control link between units.
The cluster control link must be reliable, with no out-of-order or dropped packets.
Cluster Control Link Failure
If the cluster control link line protocol goes down for a unit, then clustering is disabled; data interfaces
are shut down until you manually re-enable clustering on each affected unit (after you fix the cluster
control link.)
Note When an ASA becomes inactive, all data interfaces are shut down; only the management-only interface
can send and receive traffic. The management interface remains up using the IP address the unit received
from the cluster IP pool. However if you reload, and the unit is still inactive in the cluster, the
management interface is not accessible (because it then uses the Main IP address, which is the same as
the master unit). You must use the console port for any further configuration.
Switch Switch
Virtual Switch Link
333222
ASA1 ASA2 ASA3
To Next Page
Loading...
Need help?
General
