10-05-2015 03:18 AM - edited 03-11-2019 11:41 PM
Dears,
I hope somebody can advise me the solution, on how to treat H323 connection on newly installed ASA 5525-X cluster without inspection available?
As I understand documentation states, that H323 inspection feature in not available on the clustered devices, and I also have got notification about it from the console:
ASA(config-pmap-c)#inspect h323 h225
ERROR: This command is not allowed when clustering is enabled
ASA(config-pmap-c)# inspect h323 ras
ERROR: This command is not allowed when clustering is enabled
Please help,
Thank you in advance.
Solved! Go to Solution.
10-05-2015 09:40 PM
Hi Ivan ,
You're right, unfortunately this inspection is not supported while the ASA is configured on cluster mode. If you only have 2 ASAs you can use an Active/Active failover as workaround.
Hope it helps
-Randy-
10-05-2015 09:40 PM
Hi Ivan ,
You're right, unfortunately this inspection is not supported while the ASA is configured on cluster mode. If you only have 2 ASAs you can use an Active/Active failover as workaround.
Hope it helps
-Randy-
10-08-2015 08:37 AM
Dear Randy,
thank you very much, for reply.
I was trying to apply some workaround to keep cluster up and running, but for some reasons with no luck. Thus, I revert to failover pair, with h323 inspection available.
The question is - why there is a limitation in place? it is that hard to manage h323 session between cluster members?
03-23-2016 05:11 PM
Hi Ivan,
You can disable H323 inspection and pre-open the entire range of ports that would have been dynamically opened by H323 inspection as long as you are not doing NAT. If you are doing NAT, you can do the same if your H323 device supports setting the NAT IP within the configuration. This is not a recommendation, but a way that it can be done with clustering.
A few inspections were not supported right out of the gate with ASA clustering, but are slowly being added with newer releases. SIP inspection is one that comes to mind that is now supported with a newer release. I also need H323 inspection and hope that it is supported soon.
Thanks,
Mark
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide