Latest

Home / ASA Clustering / Cisco / Cisco ASA / Security / Part 1: Cisco ASA/FTD Inter-Site Clustering

Part 1: Cisco ASA/FTD Inter-Site Clustering

April 04, 2024 , , ,

Part 1: Cisco ASA/FTD Inter-Site Clustering

In our example 1, we are going to talk about the ASA/FTD Clustering with Individual Interface Routed Mode with North-South insertion Inter-Site which means that ASA/FTD cluster nodes at each of 2 data centers shown below in the diagram placed between inside and outside routers (North-South insertion).

Over the DCI, the cluster control link connects the cluster nodes. To load balance traffic across cluster members, each data center's interior and outside routers use PBR, ECMP, and OSPF. Unless all ASA/FTD cluster nodes at a particular site fall down, traffic remains within each data center thanks to the assignment of a higher cost route across the DCI. 

⭐Related : Cisco Secure Firewall 7.x
⭐Related : Cisco Secure Firewall: Clustering Basics

Cisco ASA/FTD Inter-Site Clustering
Fig 1.1- Cisco ASA/FTD Inter-Site Clustering

Each router sends traffic to the ASA/FTD cluster nodes at the other site via the DCI in the event that all of the cluster nodes at one site fail.

ASA/FTD Clustering, in Individual Interface Routed Mode with North-South Inter-Site configuration, creates a high availability firewall across geographically separated locations. Let's understand that 

  • ASA/FTD Clustering: This technology combines multiple ASA/FTD firewalls into a single logical unit, offering redundancy and increased availability. If one ASA/FTD fails, the others can take over seamlessly.
  • Individual Interface Mode: This clustering mode dedicates separate physical interfaces on each ASA/FTD unit for control plane (cluster communication) and data plane (incoming and outgoing traffic).
  • Routed Mode: The firewalls operate as routers, handling routing protocols and performing packet forwarding decisions.
  • North-South Traffic: This refers to traffic flowing between internal networks and the external internet. So, North-South Inter-Site means the cluster provides firewall security for traffic between your internal network and the internet at geographically separate locations.

 ⭐ Benefits of this configuration:

  • High Availability: If one ASA/FTD fails, traffic can be automatically redirected to the remaining functioning unit, minimizing downtime.
  • Scalability: You can add more ASAs/FTDs to the cluster for increased performance and capacity.
  • Centralized Management: You can manage the entire cluster from a single point.

 ⭐ Disadvantages

  • Complexity: Setting up and maintaining a clustered firewall can be more complex than managing a single firewall.
  • Latency: There can be a slight increase in latency due to the communication between the geographically separated units.
  • Limited Functionality: Not all ASA/FTD features are supported in a clustered configuration, particularly in routed mode with individual interfaces.