Thank you for joining me for ASA cluster configuration. As you know, clustering is a form of high
availability. If you would like a refresher on HA, I encourage you to watch my ASA High
Availability video. In this video, we’re going to configure
a two-node ASA cluster. I’d like to point out that this uses the traditional ASA image,
not Threat Defence. I’m also going to assume that you’ve already
seen my other ASA cluster video. If not, I’d encourage you to check it out first.
In our topology, we’ll use a pair of ASA 5500-X series firewalls, in spanned-etherchannel
mode The ASA's are connected to a pair of Nexus
switches Each ASA will have their own cluster control
links. On the Nexus side, these are vPC links The data links span the entire cluster. To
make this possible, they use spanned-etherchannel on the ASA side. The Nexus side uses vPC
We’re not going to look at how to setup vPC on the Nexus switches in this video. If
that’s something you would like to see first, check out my video on vPC configuration
Port-channel’s 101 and 102 are used on the ASA for the cluster control links
We'll put the data interfaces into a port-channel. This interface is divided into sub-interfaces.
These will become the inside, outside and DMZ named interfaces
Configuration is going to take place in 5 parts
Firstly, we’ll look at the Nexus configuration. As already mentioned, the vPC domain will
be preconfigured Next, we’ll prepare the ASA for clustering.
This includes setting global parameters and configuring the interfaces
Third, we’ll look at the actual cluster configuration
We’ll also have a look at a few settings that can be tweaked
And finally, we’ll see how to check cluster health, enable and disable members, and so on
Before beginning, we need to verify the port-channel load-balancing type. You can see here that
source and destination IP’s, as well as port numbers are used. If this was set to
something unsuitable, like source and destination MAC, we would have to change it.
On the Nexus side, we’ll create VLAN 100 for the Cluster control link.
There are four interfaces per ASA used for the CCL, two in each Nexus switch. In my lab
they connect to FEX ports, which is why the interface numbers look odd. The interfaces
for ASA-1 are added to port channel 101 Remember that the MTU needs to be set higher
on the CCL interfaces to allow for extra overhead. In this case, we’re going all the way up
to 9216 bytes. To make the port channels work across the
pair, they’re configured with a vPC identifier.
The process is repeated for the Cluster Control Link on ASA-2, using port-channel 102
There are also four data interfaces per ASA. All interfaces are added into port-channel 100 on both switches.
As this needs to be a trunk port.
We need to disable LACP graceful convergence
This won’t apply while the interface is up, so it needs to be shut down first.
Setting fixed hash distribution also requires a link flap. It’s easier to configure while the
link is still down. For more on why we’re messing
with LACP, have a look at the article on the Network Direction site.
That’s it for the Nexus switch. On to the ASA
There’s a few settings to get right on each ASA before we add it to the cluster. The first
is jumbo frames. This is to support the larger packet size on the Cluster Control Link
Next is the interface mode. Individual interface mode is set by default, but we need to change
it to spanned-etherchannel. The ‘check details’ command confirms that there’s no incompatibilities
that would get in our way. Once this is set the ASA’s are reloaded.
I’ll cut out the reload process to save your time. I have another video showing the
full ASA boot up if that’s something you really want to see.
After the reboot, we can configure the data interfaces. Each interface is added to port-channel
10, and configured with a VSS ID. This tells the ASA which Nexus switch this port is connected to
The same port-channel number needs to be used on both ASA's
The ‘span-cluster’ keyword identifies
that these interfaces are in spanned-etherchannel mode. ‘VSS load balance’ tells the ASA
that the connected switch is vPC aware. This essentially enables CLACP on the interfaces
Sub-interfaces are created and configured, which is all very straight forward
The only notable feature is that a virtual MAC address is created for each interface.
This vMAC is the same on both ASA’s
Notice that the data interfaces stay down?
This is normal. They will come up later when the cluster is configured
Alright. It’s time for the good stuff. This is what you came here for. Lets get the cluster underway
We’re going to start by creating a pool
of IP addresses for management. All up, our cluster will use three IP addresses
This is one for each ASA, as allocated from the pool, and an additional IP for managing the cluster as a whole.
The cluster IP is assigned directly on the management interface, along with the pool, created earlier
It’s now time to add all the CCL interfaces into a port-channel.
Now the part you’ve been waiting for. Let’s configure the cluster. We start by giving
it a name. Each member in the cluster has a local name as well
This is used in troubleshooting and syslogs
The ‘cluster interface’ is the CCL. We tell it which interface to use, and assign
an IP address The priority is used to influence the election
of the primary unit. The key is optional, but is recommended for security
Finally, ‘enable’ clustering on this unit. This warning shows any incompatible configuration
we have, and confirms that we’re happy to remove it
The cluster begins the election process. Notice that there can be no config changes until
there is a primary ASA. Eventually, this member is elected as the
primary. This is not surprising, as it is the only cluster member. We’re now free
to set the MTU The configuration is repeated on ASA-2
Once clustering is enabled, the configuration is replicated from the primary, and this member
becomes a secondary. You might notice that ‘master’ and ‘slave’
are shown in the output. The documentation is moving toward using ‘primary’ and ‘secondary’ terminology.
For ease of troubleshooting, it’s good to have all console messages on secondary units
replicated to the primary The members send health messages over the
CCL every three seconds. We’re going to keep the default timer, but we’re going
to tell the cluster that it is connected to vPC enabled switches. This helps prevent the
ASA from thinking that the cluster is down if one switch reboots
Connection rebalancing allows an overloaded member to pass off some connections to other
members. I’m only doing it to show you how it’s done. I wouldn’t recommend using
it in production Have you noticed that we’re not making any
changes on the secondary? Now that the cluster is up, changes are only made on the primary
Lets take a few moments to verify the configuration. Firstly, use ‘show cluster interface-mode’
to confirm that we’re in spanned-etherchannel mode
Use ‘show cluster info’ to see the cluster members. This will show the state of the current
member, and which one is the ‘master’ or primary
‘show cluster info health’ shows us the state of the cluster as a whole. In our case,
the cluster is healthy. We can also see interface state for each member
Lets get a bit more proactive, and remove a member from the cluster. This is done by
entering cluster configuration mode, and typing ‘no enable’. The ASA transitions to the
DISABLED state, and in this case, another member is elected as primary.
The cluster still shows as healthy, as the member was gracefully removed
The ASA cluster does not see this as a failure
Lets put it back into the cluster
Notice that it does not automatically become the primary, even though it has a better priority.
This is because pre-emption is not used in the cluster.
We can manually make it the primary with the ‘cluster master unit’ command…
As soon as it’s ready that is…
The ‘cluster remove unit’ command can
be used to remove a remote unit. This is useful if you don’t have console access to it.
… And let’s add it back in.
Finally, use the ‘cluster exec’ command If you need to run a remote command on a unit
So, that’s it! Your cluster’s all done, and you’re ready to go. I hope you’ve enjoyed this video. Let me
know what you thought in the comments below. Don’t forget to subscribe or follow me on
twitter to find out about new videos and articles. Thanks again for watching