Active/Active limitations - ASA Multi-context

[m.s.rees1]

Hi,

I have read a few times recently about the limitations when setting up firewalls in Active/Active but they are always older posts. Can anyone confirm the current limitations with Active/Active or even Active/Standby?

We have a multi-context firewall that will be running VPNs and that was one of the limitations that has been mentioned in older posts. Just wondering if this is still the case and anything to look out for.

Thanks.

[balaji.bandi]

Depends on the model and Code running always mentioned in the configuraiton guide, that is official :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/general/asa-914-general-config/ha-contexts.html?bookSearch=true#id_59703

[Rob Ingram]

@m.s.rees1 the old guides are still pretty relevant tbh, as not much has changed in regard to functionality and support for multi-context. VPN's are supported on A/A https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/ha-contexts.html#id_59703 VTI's are still unsuppported however.

[m.s.rees1]

@Rob Ingram @balaji.bandi 

Thanks for the replies. What I don't understand is that in this document it mentions the following:

In the list it states that (for example) Ikev1 is not supported in multiple-context mode, however without realising this was a limitation I have set one up, tested and it seemed to work fine. So is the limitation around the failover side of multi-contexts?


Thanks.

[Rob Ingram · Accepted solution]

@m.s.rees1 thats for Remote Acccess VPN, which doesn't use IKEv1 anyway (only SSL/TLS or IKEv2)