cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

557
Views
5
Helpful
3
Replies
Ivan Prikhodko
Beginner

Cisco ASA cluster H323 inspection issue

Dears,

 

I hope somebody can advise me the solution, on how to treat H323 connection on newly installed ASA 5525-X cluster without inspection available?

As I understand documentation states, that H323 inspection feature in not available on the clustered devices, and I also have got notification about it from the console:

ASA(config-pmap-c)#inspect h323 h225

ERROR: This command is not allowed when clustering is enabled

ASA(config-pmap-c)# inspect h323 ras

ERROR: This command is not allowed when clustering is enabled

 

Please help,

Thank you in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
rvarelac
Rising star

Hi Ivan , 

 

You're right, unfortunately this inspection is not supported while the ASA is configured on cluster mode. If you only have 2 ASAs you can use an Active/Active failover as workaround. 

 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html

 

Hope it helps

-Randy-

View solution in original post

3 REPLIES 3
rvarelac
Rising star

Hi Ivan , 

 

You're right, unfortunately this inspection is not supported while the ASA is configured on cluster mode. If you only have 2 ASAs you can use an Active/Active failover as workaround. 

 

http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_cluster.html

 

Hope it helps

-Randy-

View solution in original post

Dear Randy,

 

thank you very much, for reply.

I was trying to apply some workaround to keep cluster up and running, but for some reasons with no luck. Thus, I revert to failover pair, with h323 inspection available.

The question is - why there is a limitation in place? it is that hard to manage h323 session between cluster members?

Hi Ivan,

You can disable H323 inspection and pre-open the entire range of ports that would have been dynamically opened by H323 inspection as long as you are not doing NAT. If you are doing NAT, you can do the same if your H323 device supports setting the NAT IP within the configuration. This is not a recommendation, but a way that it can be done with clustering.

A few inspections were not supported right out of the gate with ASA clustering, but are slowly being added with newer releases. SIP inspection is one that comes to mind that is now supported with a newer release. I also need H323 inspection and hope that it is supported soon.

Thanks,
Mark

Content for Community-Ad