Cisco PIX 500 Series Configuration Manual page 256

Configuring Failover
You can prevent the return packets from being dropped using the asr-group command on interfaces
where this is likely to occur. When an interface configured with the asr-group command receives a
packet for which it has no session information, it checks the session information for the other interfaces
that are in the same group. If it does not find a match, the packet is dropped. If it finds a match, then one
of the following actions occurs:
If the incoming traffic originated on a peer unit, some or all of the layer 2 header is rewritten and
•
the packet is redirected to the other unit. This redirection continues as long as the session is active.
If the incoming traffic originated on a different interface on the same unit, some or all of the layer
•
2 header is rewritten and the packet is reinjected into the stream.
Note Using the asr-group command to configure asymmetric routing support is more secure than using the
static command with the nailed option.
The asr-group command does not provide asymmetric routing; it restores asymmetrically routed packets
to the correct interface.
Prerequisites
You must have to following configured for asymmetric routing support to function properly:
Active/Active Failover
•
Stateful Failover—passes state information for sessions on interfaces in the active failover group to
•
the standby failover group.
replication http—HTTP session state information is not passed to the standby failover group, and
•
therefore is not present on the standby interface. For the security appliance to be able re-route
asymmetrically routed HTTP packets, you need to replicate the HTTP state information.
You can configure the asr-group command on an interface without having failover configured, but it
does not have any effect until Stateful Failover is enabled.
Configuring Support for Asymmetrically Routed Packets
To configure support for asymmetrically routed packets, perform the following steps:
Configure Active/Active Stateful Failover for the failover pair. See
Step 1
page
For each interface that you want to participate in asymmetric routing support enter the following
Step 2
command. You must enter the command on the unit where the context is in the active state so that the
command is replicated to the standby failover group. For more information about command replication,
see Command Replication, page
hostname/ctx(config)# interface phy_if
hostname/ctx(config-if)# asr-group num
Valid values for num range from 1 to 32. You need to enter the command for each interface that
participates in the asymmetric routing group. You can view the number of ASR packets transmitted,
received, or dropped by an interface using the show interface detail command. You can have more than
one ASR group configured on the security appliance, but only one per interface. Only members of the
same ASR group are checked for session information.
Cisco Security Appliance Command Line Configuration Guide
14-36
14-27.
14-12.
Chapter 14 Configuring Failover
Configuring Active/Active Failover,
OL-12172-03