1-18
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Information About ASA Clustering
• Failover
• ASA CX module
Centralized Features
The following features are only supported on the master unit, and are not scaled for the cluster. For
example, you have a cluster of eight units (5585-X with SSP-60). The Other VPN license allows a
maximum of 10,000 site-to-site IPsec tunnels for one ASA 5585-X with SSP-60. For the entire cluster
of eight units, you can only use 10,000 tunnels; the feature does not scale.
Note Traffic for centralized features is forwarded from member units to the master unit over the cluster control
link; see the “Sizing the Cluster Control Link” section on page 1-7 to ensure adequate bandwidth for the
cluster control link.
If you use the rebalancing feature (see the “Rebalancing New TCP Connections Across the Cluster”
section on page 1-17), traffic for centralized features may be rebalanced to non-master units before the
traffic is classified as a centralized feature; if this occurs, the traffic is then sent back to the master unit.
For centralized features, if the master unit fails, all connections are dropped, and you have to re-establish
the connections on the new master unit.
• Site-to-site VPN
• The following application inspections:
–
DCERPC
–
NetBios
–
PPTP
–
RADIUS
–
RSH
–
SUNRPC
–
TFTP
–
XDMCP
• Dynamic routing (Spanned EtherChannel mode only)
• Multicast routing (Individual interface mode only)
• Static route monitoring
• IGMP multicast control plane protocol processing (data plane forwarding is distributed across the
cluster)
• PIM multicast control plane protocol processing (data plane forwarding is distributed across the
cluster)
• Authentication and Authorization for network access. Accounting is decentralized.
• Filtering Services
Features Applied to Individual Units
These features are applied to each ASA unit, instead of the cluster as a whole or to the master unit.
To Next Page
Loading...
Need help?
General
