Converting Cisco ASA from active/standby to active/active

[OlayinkaRookie]

Hello all,

We're currently running a pair of 5555X in active/standby mode and have recently started seeing CPU utilization as high as 93% during peak period. We're considering changing the failover mode to active/active to see if we can share the load among the 2 physical firewalls and hopefully see reduced CPU utilization on the current active firewall. 

I'm curious to know if some of you here have implemented this and what challenges you faced. To give a little more context, we have over 450 AnyConnect users on this firewall, 4 IPSec VPNs, it's the primary internet edge device and it has a firepower module attached.

@spfister336

@balaji.bandi

[Marvin Rhoads]

Active-Active on ASA is only applicable for multiple context mode whereby a given context(s) is/are Active on one firewall and other context(s) is/are Active on the other. If you don't have a use case for multiple context (most commonly used for multi-tenancy or other similar completely separate firewalls running on one device (or HA pair) then it generally would not help.

You should open a TAC case and resolve the CPU issue satisfactorily. That would be the right way to approach your issue.

[OlayinkaRookie]

Thanks Marvin.

We've opened multiple tickets with Cisco TAC and the conclusion is that the firewall is just processing a lot of traffic. That's why I added the extra details in my first post.

DATAPATH..that's the process that takes all of the CPU.

[MHM Cisco World]

You need license I think for multi context 

You can instead get new firepower and use it only for anyconnect' you mention 450 so these high numbers I think need dedicat fw.

MHM

[balaji.bandi]

adding to other post :

Try troubleshoot the issue and also make sure you have upgraded to latest stable version (that can fix any bugs and issue)

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113185-asaperformance.html