Cisco ASA cluster H323 inspection issue

[Ivan Prikhodko]

Dears,

I hope somebody can advise me the solution, on how to treat H323 connection on newly installed ASA 5525-X cluster without inspection available?

As I understand documentation states, that H323 inspection feature in not available on the clustered devices, and I also have got notification about it from the console:

ASA(config-pmap-c)#inspect h323 h225

ERROR: This command is not allowed when clustering is enabled

ASA(config-pmap-c)# inspect h323 ras

ERROR: This command is not allowed when clustering is enabled

Please help,

Thank you in advance.

[rvarelac · Accepted solution]

Hi Ivan , 

You're right, unfortunately this inspection is not supported while the ASA is configured on cluster mode. If you only have 2 ASAs you can use an Active/Active failover as workaround. 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html

Hope it helps

-Randy-

[Ivan Prikhodko]

Dear Randy,

thank you very much, for reply.

I was trying to apply some workaround to keep cluster up and running, but for some reasons with no luck. Thus, I revert to failover pair, with h323 inspection available.

The question is - why there is a limitation in place? it is that hard to manage h323 session between cluster members?

[MARK BAKER]

Hi Ivan,

You can disable H323 inspection and pre-open the entire range of ports that would have been dynamically opened by H323 inspection as long as you are not doing NAT. If you are doing NAT, you can do the same if your H323 device supports setting the NAT IP within the configuration. This is not a recommendation, but a way that it can be done with clustering.

A few inspections were not supported right out of the gate with ASA clustering, but are slowly being added with newer releases. SIP inspection is one that comes to mind that is now supported with a newer release. I also need H323 inspection and hope that it is supported soon.

Thanks,
Mark