Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-14
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Information About ASA Clustering
Policy-Based Routing (Routed Firewall Mode Only)
When using Individual interfaces, each ASA interface maintains its own IP address and MAC address.
One method of load balancing is Policy-Based Routing (PBR).
We recommend this method if you are already using PBR, and want to take advantage of your existing
infrastructure. This method might offer additional tuning options vs. Spanned EtherChannel as well.
PBR makes routing decisions based on a route map and ACL. You must manually divide traffic between
all ASAs in a cluster. Because PBR is static, it may not achieve the optimum load balancing result at all
times. To achieve the best performance, we recommend that you configure the PBR policy so that
forward and return packets of a connection are directed to the same physical ASA. For example, if you
have a Cisco router, redundancy can be achieved by using IOS PBR with Object Tracking. IOS Object
Tracking monitors each ASA using ICMP ping. PBR can then enable or disable route maps based on
reachability of a particular ASA. See the following URLs for more details:
http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a4409.shtml
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtpbrtrk.html#wp1057830
Note If you use this method of load-balancing, you can use a device-local EtherChannel as an Individual
interface.
Router or
Access Switch
Virtual Switch Link
Router or
Access Switch
Virtual Switch Link
333215
ASA1
ASA2
ASA3
ASA4
ASA1
ASA8
Switch 2Switch 1Switch 2Switch 1
port-channel1
port-channel1 port-channel1
port-channel1

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English