If you're only going to learn one thing from Jurassic Park, It's gotta be this:
Your IT systems need to be built redundantly
Hammond: Spared no expense...
Really Hammond? Then why did you only hire one decent IT guy?
Arnold: I can't get Jurassic Park back online without Dennis Nedry
OK, ok, I know. We shouldn’t be learning IT from Jurassic Park. But, it’s true that high availability is critical in an enterprise grade network.
A single point of failure in the network is dangerous.
There is no problem while the device is up, but if there is a failure, packets are dropped.
Using high-availability works around this limitation. If one device fails, the other carries on passing traffic
In this video, we’ll have a look at two types of HA; Failover, and clustering.
Please note that this is for the classic ASA image, which is different to Threat Defence
Failover mode has two subtypes. These are Active/Standby and Active/Active.
Both types of failover use two ASA’s in a pair
When using active/standby failover mode, only the active node passes traffic
The standby waits and watches the active
If it sees the active fail, it takes over as the active ASA
The new active ASA continues to pass traffic.
When the failed unit has been repaired, it remains in standby mode
The downside to this model, is that half of your investment is sitting there mostly unused
On the upside, all ASA features are supported
Active/Active failover also uses two ASA’s.
As implied in the name, both nodes actively forward traffic.
To achieve this, the ASA uses a special trick. Each of the ASA’s runs two contexts
One context is active, and one is standby. There are now four virtual firewalls, running as two active/standby failover pairs.
The active contexts forward traffic, while the standby context waits
If an ASA fails, the standby transitions to active, and takes over the role of forwarding traffic
The good thing about active/active failover, is that both ASA’s are actively used. You’re getting the full value of you’re investment
The downside is the added complexity, and that you can’t use contexts anywhere else
In an ASA cluster, all units are active, without needing to use contexts
The smaller ASA’s can have up to two nodes per cluster. If you’re using the 5585’s you can have up to 16 nodes active in the cluster
If an ASA fails, the other ASA’s will take over forwarding that traffic
If you’re fortunate enough to have the 5585 model, you can span your cluster across two sites.
This is called inter-site clustering. Make sure you have a good DCI link though, it needs to be reliable, it needs to have plenty of bandwidth, and it needs to have low latency
The primary advantage of clustering is that all ASA’s are active, and contexts are not required. Also, you can use more than two ASA’s, which makes it scalable
The downside is that some features are not supported in a cluster. Be sure to check Cisco’s website to get a list of features that you can and cannot use
One final thing of note, is that clustering applies only to ASA firewall functions. Modules, such as Firepower, are independent, and not clustered
Thank you for joining me in this brief introduction to ASA high availability. I hope you’ve enjoyed it
If you’ve enjoyed this video, or if it’s been helpful in any way, please ‘like’ the video, or drop a comment below.
Please subscribe to this channel or follow me on twitter to be notified of new videos and articles.
Thankyou for watching