ASA cluster

[ahmede1]

Good day,

We have ASA cluster, routing is symmetrical, so whatever traffic leaves through the master F/W it returns through the same firewall, same with the slave.. According to my limited understanding to how cluster works (I'm network guy not a security guy), we shouldn't see any user traffic on the CCL link, however we still see some traffic on the links.. Can someone to please explain why?

Thank you in advance

[Marius Gunnerud]

If traffic happens to arrive on one of the slaves (or master for that matter) where another firewall is the flow owner, that traffic is forwarded to the flow owner for further processing.  It might be this traffic that you are seeing.