- last edited on by
Kelli Glass
With Prashanth Goutham R.
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about the Configuring, Troubleshooting & Best Practices on Adaptive Security Appliances (ASA) & Firewall Services Module (FWSM) Failover with Prashanth Goutham.
Firewall Services Module (FWSM) is a high-performance stateful-inspection firewall that integrates into the Cisco® 6500 switch and 7600 router chassis. The FWSM monitors traffic flows using application inspection engines to provide a strong level of network security. Cisco ASA protects networks of all sizes with MultiScale performance and a comprehensive suite of highly integrated, market-leading security services.
Prashanth Goutham is an experienced support engineer with the High Touch Technical Support (HTTS) Security team, covering all Cisco security technologies. During his four years with Cisco, he has worked with Cisco's major customers, troubleshooting routing, LAN switching, and security technologies. He is also qualified as a GIAC Certified Incident Handler (GCIH) by the SANS Institute.
Remember to use the rating system to let Prashanth know if you have received an adequate response.
Prashanth might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community forum shortly after the event. This event lasts through July 13, 2012. Visit this forum often to view responses to your questions and the questions of other community members.
Hello Karthik,
Yes we can use the same Physical Interface for both the Failover Lan and State links, it should not be a problem. However this has to be planned well, for example you have 8 interfaces (6 Gig + 2 FA) and you make the FA Interface the Failover + State Link, i would say its a bad design and you are in for frequent failovers.
--- Always make sure that your Failover + State Interfaces are having equal to the highest capacity interfaces especially when you have http replication enabled i would suggest that you try to have seperate Fail & State links configured.
--- Also i would advice not to use the onboard GE interfaces as they are not as powerful as the module interfaces, meaning it is not multi threaded and only one Core is used to pull data off those interfaces.
--- Make sure if you have a 5580 or higher to use the command show io-bridge to make sure that the distribution between the 2 io-slots are equal.
What i've mentioned above is from my experience on what i see working best, but also consider what is mentioned on the ASA Configuration guide about the same:
Failover Interface Speed for Stateful Links
If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.
Use the following failover interface speed guidelines for the adaptive security appliances:
•
Cisco ASA 5510
–
•
–
•
–
For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than10 milliseconds, some performance degradation occurs due to retransmission of failover messages.
All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html#wp1077536
Hope that helps.
