Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 279 / 2164

1-15
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring a Cluster of ASAs
Information About ASA Clustering
Equal-Cost Multi-Path Routing (Routed Firewall Mode Only)
When using Individual interfaces, each ASA interface maintains its own IP address and MAC address.
One method of load balancing is Equal-Cost Multi-Path (ECMP) routing.
We recommend this method if you are already using ECMP, and want to take advantage of your existing
infrastructure. This method might offer additional tuning options vs. Spanned EtherChannel as well.
ECMP routing can forward packets over multiple “best paths” that tie for top place in the routing metric.
Like EtherChannel, a hash of source and destination IP addresses and/or source and destination ports can
be used to send a packet to one of the next hops. If you use static routes for ECMP routing, then an ASA
failure can cause problems; the route continues to be used, and traffic to the failed ASA will be lost. If
you use static routes, be sure to use a static route monitoring feature such as Object Tracking. We
recommend using dynamic routing protocols to add and remove routes, in which case, you must
configure each ASA to participate in dynamic routing.
Note
If you use this method of load-balancing, you can use a device-local EtherChannel as an Individual
interface.
How the ASA Cluster Manages Connections
•
Connection Roles, page 1-15
•
New Connection Ownership, page 1-16
•
Sample Data Flow, page 1-16
•
Rebalancing New TCP Connections Across the Cluster, page 1-17
Connection Roles
There are 3 different ASA roles defined for each connection:
•
Owner—The unit that initially receives the connection. The owner maintains the TCP state and
processes packets. A connection has only one owner.
•
Director—The unit that handles owner lookup requests from forwarders and also maintains the
connection state to serve as a backup if the owner fails. When the owner receives a new connection,
it chooses a director based on a hash of the source/destination IP address and TCP ports, and sends
a message to the director to register the new connection. If packets arrive at any unit other than the
owner, the unit queries the director about which unit is the owner so it can forward the packets. A
connection has only one director.
•
Forwarder—A unit that forwards packets to the owner. If a forwarder receives a packet for a
connection it does not own, it queries the director for the owner, and then establishes a flow to the
owner for any other packets it receives for this connection. The director can also be a forwarder.
Note that if a forwarder receives the SYN-ACK packet, it can derive the owner directly from a SYN
cookie in the packet, so it does not need to query the director. (If you disable TCP sequence
randomization, the SYN cookie is not used; a query to the director is required.) For short-lived flows
such as DNS and ICMP, instead of querying, the forwarder immediately sends the packet to the
director, which then sends them to the owner. A connection can have multiple forwarders; the most
efficient throughput is achieved by a good load-balancing method where there are no forwarders and
all packets of a connection are received by the owner.