Cisco ASA 5512-X Cli Configuration Guide

1-16
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Information About ASA Clustering
New Connection Ownership
When a new connection is directed to a member of the cluster via load balancing, that unit owns both
directions of the connection. If any connection packets arrive at a different unit, they are forwarded to
the owner unit over the cluster control link. For best performance, proper external load balancing is
required for both directions of a flow to arrive at the same unit, and for flows to be distributed evenly
between units. If a reverse flow arrives at a different unit, it is redirected back to the original unit. For
more information, see the “Load Balancing Methods” section on page 1-12.
Sample Data Flow
The following example shows the establishment of a new connection.
1. The SYN packet originates from the client and is delivered to an ASA (based on the load balancing
method), which becomes the owner. The owner creates a flow, encodes owner information into a
SYN cookie, and forwards the packet to the server.
2. The SYN-ACK packet originates from the server and is delivered to a different ASA (based on the
load balancing method). This ASA is the forwarder.
3. Because the forwarder does not own the connection, it decodes owner information from the SYN
cookie, creates a forwarding flow to the owner, and forwards the SYN-ACK to the owner.
4. The owner sends a state update to the director, and forwards the SYN-ACK to the client.
5. The director receives the state update from the owner, creates a flow to the owner, and records the
TCP state information as well as the owner. The director acts as the backup owner for the
connection.
6. Any subsequent packets delivered to the forwarder will be forwarded to the owner.
7. If packets are delivered to any additional units, it will query the director for the owner and establish
a flow.
8. Any state change for the flow results in a state update from the owner to the director.
Client
SYN/ACK
1. SYN 1. SYN
2. SYN/ACK
4. State update
3. SYN/ACK
Director
Cluster
Server
Owner
Forwarder
After step 4, all
remaining packets
are forwarded
directly to the owner.
333480
Inside Outside

Cisco ASA 5512-X Specifications

General

Brand	Cisco
Model	ASA 5512-X
Category	Firewall
Language	English