topic Re: Latency limit between 2 secure firewall clusters between DC's in Network Security

Latency limit between 2 secure firewall clusters between DC's

blue phoenix — Fri, 30 Jul 2021 05:32:21 GMT

Hi,

Does anyone know where I can find this information? We are trying to design a NextGen DC and it's one of the requirements.

Thanks,

Re: Latency limit between 2 secure firewall clusters between DC's

Marvin Rhoads — Fri, 30 Jul 2021 07:10:23 GMT

The Cluster Control Link (CCL) must have L2 reachability with <10ms of latency.

Source: Cisco Live presentation BRKSEC-3032 by Andrew Ossipov.

Re: Latency limit between 2 secure firewall clusters between DC's

balaji.bandi — Fri, 30 Jul 2021 09:38:13 GMT

in addition to to @Marvin Rhoads comments.

look at the deployment guide :

luster Control Link Reliability for Inter-Chassis Clustering

To ensure cluster control link functionality, be sure the round-trip time (RTT) between units is less than 20 ms. This maximum latency enhances compatibility with cluster members installed at different geographical sites. To check your latency, perform a ping on the cluster control link between units.

The cluster control link must be reliable, with no out-of-order or dropped packets; for example, for inter-site deployment, you should use a dedicated link.

https://www.cisco.com/c/en/us/td/docs/security/firepower/fxos/clustering/ftd-cluster-solution.html#concept_6321258BF0C640489F33AF82CDD53B4C

Re: Latency limit between 2 secure firewall clusters between DC's

blue phoenix — Tue, 24 Aug 2021 14:25:32 GMT

I don't think that will be a viable solution since the ping RTT from Vancouver to Chicago is 40+ ms. Does that mean this solution is not viable for transatlantic distances?