Cisco ASA Series Cli Configuration Manual page 278

Information About ASA Clustering
Switch 1
port-channel1
Policy-Based Routing (Routed Firewall Mode Only)
When using Individual interfaces, each ASA interface maintains its own IP address and MAC address.
One method of load balancing is Policy-Based Routing (PBR).
We recommend this method if you are already using PBR, and want to take advantage of your existing
infrastructure. This method might offer additional tuning options vs. Spanned EtherChannel as well.
PBR makes routing decisions based on a route map and ACL. You must manually divide traffic between
all ASAs in a cluster. Because PBR is static, it may not achieve the optimum load balancing result at all
times. To achieve the best performance, we recommend that you configure the PBR policy so that
forward and return packets of a connection are directed to the same physical ASA. For example, if you
have a Cisco router, redundancy can be achieved by using IOS PBR with Object Tracking. IOS Object
Tracking monitors each ASA using ICMP ping. PBR can then enable or disable route maps based on
reachability of a particular ASA. See the following URLs for more details:
http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a4409.shtml
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtpbrtrk.html#wp1057830
Note
If you use this method of load-balancing, you can use a device-local EtherChannel as an Individual
interface.
Cisco ASA Series CLI Configuration Guide
1-14
Router or
Access Switch
Switch 2
Virtual Switch Link
ASA1
ASA2
ASA3
port-channel1
ASA4
Chapter 1
Router or
Access Switch
Switch 1
Virtual Switch Link
ASA1
port-channel1 port-channel1
ASA8
Configuring a Cluster of ASAs
Switch 2