topic You could use separate 4948 in Network Security

ASA clustering

Andrej Zverev — Tue, 12 Mar 2019 04:54:46 GMT

Hello!

Can anyone explain is this list of switches are complete? For example 4500x or Nexus 3064 can do same(VSS/vPC), I think, but they are not listed.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/general/asa-general-cli/ha-cluster.html

See: Table 7-2 External Hardware and Software Support for ASA Clustering

The ones listed are the ones

Marvin Rhoads — Sun, 12 Oct 2014 14:21:06 GMT

The ones listed are the ones Cisco has tested and verified compatible. Other models may work fine but haven't necessarily been tested.

The Etherchannel / LACP mechanisms are pretty sensitive though for interoperability with an ASA cluster so proceed carefully when going outside the recommended switch types. I'd say especially so when working with a VSS- or VPC-enable downstream set of of switches.

You can always open a proactive TAC case to ask them to validate your configuration and check their internal knowledge base for possible concerns.

Thank you! Will try asks

Andrej Zverev — Sun, 12 Oct 2014 15:02:44 GMT

Thank you! Will try asks details from TAC

Hi MArvin , Can in configure

startx001 — Mon, 01 Dec 2014 11:35:21 GMT

Hi Marvin ,

Can in configure cluster on ASA , if i have two 4948 on separate ASA ?

4948 will in inside interfaces.

Topology is in picture .

Is there any link where i can see difference between ASA cluster , and ASA Active/Active mode .

Regarding data flow , capacity etc

I asume that Active/Active is capable only with two ASA , and ASA Cluster is capable up to 8 ASA .

You could use separate 4948

Marvin Rhoads — Mon, 01 Dec 2014 14:50:35 GMT

You could use separate 4948 switches in the one side if you setup the cluster in individual interface mode. However the Cisco recommendation is to use spanned Etherchannel which is only possible when the switches are in a stack, VSS or VPC configuration - all things the 4948 cannot do.

Active/Active term is generally used to refer to an HA mode that is only available in multiple context ASA configurations. The overall pair is active/active but a given context is always active/standby.

You might find the Cisco live presentation BRKSEC-3032 useful. Also listen to the TAC Security podcasts on ASA clustering.

Ok, I'm sharing some

Andrej Zverev — Tue, 03 Feb 2015 14:44:34 GMT

Ok, I'm sharing some information after talking with cisco's guys.

You can use any switch, but switches from list are confirmed what they are doing proper traffic distribution, like if you have pair of ASA in cluster in this case a good switch can do almost 50/50 traffic distribution and bad switch can do 70/30 and in this case some of your ASA's can be overloaded.

That's all 🙂