Cisco ASA Series Cli Configuration Manual page 282

Information About ASA Clustering
•
•
Centralized Features
The following features are only supported on the master unit, and are not scaled for the cluster. For
example, you have a cluster of eight units (5585-X with SSP-60). The Other VPN license allows a
maximum of 10,000 site-to-site IPsec tunnels for one ASA 5585-X with SSP-60. For the entire cluster
of eight units, you can only use 10,000 tunnels; the feature does not scale.
Note
Traffic for centralized features is forwarded from member units to the master unit over the cluster control
link; see the
cluster control link.
If you use the rebalancing feature (see the
section on page
traffic is classified as a centralized feature; if this occurs, the traffic is then sent back to the master unit.
For centralized features, if the master unit fails, all connections are dropped, and you have to re-establish
the connections on the new master unit.
•
•
•
•
•
•
•
•
•
Features Applied to Individual Units
These features are applied to each ASA unit, instead of the cluster as a whole or to the master unit.
Cisco ASA Series CLI Configuration Guide
1-18
Failover
ASA CX module
"Sizing the Cluster Control Link" section on page 1-7
1-17), traffic for centralized features may be rebalanced to non-master units before the
Site-to-site VPN
The following application inspections:
–
DCERPC
–
NetBios
–
PPTP
–
RADIUS
–
RSH
–
SUNRPC
–
TFTP
–
XDMCP
Dynamic routing (Spanned EtherChannel mode only)
Multicast routing (Individual interface mode only)
Static route monitoring
IGMP multicast control plane protocol processing (data plane forwarding is distributed across the
cluster)
PIM multicast control plane protocol processing (data plane forwarding is distributed across the
cluster)
Authentication and Authorization for network access. Accounting is decentralized.
Filtering Services
Chapter 1
to ensure adequate bandwidth for the
"Rebalancing New TCP Connections Across the Cluster"
Configuring a Cluster of ASAs