Cisco ASA Series User Manual

1-65
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Configuration Examples for ASA Clustering
interface port-channel 2
nameif management
ip address 10.1.1.1 255.255.255.0 cluster-pool mgmt
ipv6 address 2001:DB8::1001/64 cluster-pool mgmtipv6
security-level 100
management-only
ip local pool inside 10.10.10.6-10.10.10.9
ipv6 local pool insideipv6 2001:DB8:4:4/64 4
interface redundant 1
member-interface tengigabitethernet 1/6
member-interface tengigabitethernet 1/7
nameif inside
ip address 10.10.10.5 255.255.255.0 cluster-pool inside
ipv6 address 2001:DB8:4:3/64 cluster-pool insideipv6
security-level 100
ip local pool outside 209.165.201.2-209.165.201.5
ipv6 local pool outsideipv6 2001:DB8:DD:2/64 4
interface redundant 2
member-interface tengigabitethernet 0/8
member-interface tengigabitethernet 0/9
nameif outside
ip address 209.165.201.1 255.255.255.224 cluster-pool outside
ipv6 address 2001:DB8:DD:1/64 cluster-pool outsideipv6
security-level 0
Spanned EtherChannel With Backup Links
The maximum number of active ports in an etherchannel is limited to 8 from the switch side. If you have
an 8-ASA cluster, and you allocate 2 ports per unit to the EtherChannel, for a total of 16 ports total, then
8 of them have to be in standby mode. The ASA uses LACP to negotiate which links should be active or
standby. If you enable multi-switch EtherChannel using VSS or vPC, you can achieve inter-switch
redundancy. On the ASA, all physical ports are ordered first by the slot number then by the port number.
In the following figure, the lower ordered port is the “primary” port (for example, GigabitEthernet 0/0),
and the other one is the “secondary” port (for example, GigabitEthernet 0/1). You must guarantee
symmetry in the hardware connection: all primary links must terminate on one switch, and all secondary
links must terminate on another switch if VSS/vPC is used. The following diagram shows what happens
when the total number of links grows as more units join the cluster:

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English