ASA Failover bandwidth and latency requirements

Answered Question
May 6th, 2009
User Badges:

Hi

Do Cisco have recommendations on minimum bandwidth/latency for the failover and state sync links between active/passive units?

Client wishes to geographically separate primary and secondary units over a layer2 WAN (Ethernet extension service).

Thanks

Correct Answer by srue about 8 years 2 months ago

from the failover documentation:


Failover Interface Speed for Stateful Links


If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.


Use the following failover interface speed guidelines for Cisco PIX security appliances and Cisco ASA adaptive security appliances:


•Cisco ASA 5520/5540/5550 and PIX 515E/535


-The stateful link speed should match the fastest data link


•Cisco ASA 5510 and PIX 525


-Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.


For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than 10 milliseconds, some performance degradation occurs due to retransmission of failover messages.


All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
srue Wed, 05/06/2009 - 06:23
User Badges:
  • Blue, 1500 points or more

from the failover documentation:


Failover Interface Speed for Stateful Links


If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.


Use the following failover interface speed guidelines for Cisco PIX security appliances and Cisco ASA adaptive security appliances:


•Cisco ASA 5520/5540/5550 and PIX 515E/535


-The stateful link speed should match the fastest data link


•Cisco ASA 5510 and PIX 525


-Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.


For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than 10 milliseconds, some performance degradation occurs due to retransmission of failover messages.


All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.

Actions

This Discussion