Cisco ASA Series Cli Configuration Manual page 286

Information About ASA Clustering
AAA for Network Access
AAA for network access consists of three components: authentication, authorization, and accounting.
Authentication and accounting are implemented as centralized features on the clustering master with
replication of the data structures to the cluster slaves. If a master is elected, the new master will have all
the information it needs to continue uninterrupted operation of the established authenticated users and
their associated authorizations. Idle and absolute timeouts for user authentications are preserved when a
master unit change occurs.
Accounting is implemented as a distributed feature in a cluster. Accounting is done on a per-flow basis,
so the cluster unit owning a flow will send accounting start and stop messages to the AAA server when
accounting is configured for a flow.
Syslog and Netflow
•
•
SNMP
An SNMP agent polls each individual ASA by its Local IP address. You cannot poll consolidated data
for the cluster.
You should always use the Local address, and not the Main cluster IP address for SNMP polling. If the
SNMP agent polls the Main cluster IP address, if a new master is elected, the poll to the new master unit
will fail.
VPN
Site-to-site VPN is a centralized feature; only the master unit supports VPN connections.
Note
Remote access VPN is not supported with clustering.
VPN functionality is limited to the master unit and does not take advantage of the cluster high
availability capabilities. If the master unit fails, all existing VPN connections are lost, and VPN users
will see a disruption in service. When a new master is elected, you must reestablish the VPN
connections.
When you connect a VPN tunnel to a Spanned EtherChannel address, connections are automatically
forwarded to the master unit. For connections to an Individual interface when using PBR or ECMP, you
must always connect to the Main cluster IP address, not a Local address.
VPN-related keys and certificates are replicated to all units.
Cisco ASA Series CLI Configuration Guide
1-22
Syslog—Each unit in the cluster generates its own syslog messages. You can configure logging so
that each unit uses either the same or a different device ID in the syslog message header field. For
example, the hostname configuration is replicated and shared by all units in the cluster. If you
configure logging to use the hostname as the device ID, syslog messages generated by all units look
as if they come from a single unit. If you configure logging to use the local-unit name that is
assigned in the cluster bootstrap configuration as the device ID, syslog messages look as if they
come from different units. See the
Messages" section on page
NetFlow—Each unit in the cluster generates its own NetFlow stream. The NetFlow collector can
only treat each ASA as a separate NetFlow exporter.
"Including the Device ID in Non-EMBLEM Format Syslog
1-17.
Chapter 1 Configuring a Cluster of ASAs