does anybody have any hard & fast rules or 'rule of thumb' type guidlines for how big the state links have to be with an ASA 5580 running multiple contexts ? For example as you add more contexts, you are of course firewalling more traffic --how does this impact how big your state links should be.
We are currently debating whether or not our state links should be 10g , or if 1g will suffice ; our "firewalling" interfaces are 1g, but we have a mulit-context design that should be scaleble. thanks for any input
If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.
Use the following failover interface speed guidelines for Cisco PIX security appliances and Cisco ASA adaptive security appliances:
•Cisco ASA 5520/5540/5550 and PIX 515E/535
–The stateful link speed should match the fastest data link
•Cisco ASA 5510 and PIX 525
–Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.
For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than 10 milliseconds, some performance degradation occurs due to retransmission of failover messages.
All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.
For Cisco ASA 5580 adaptive security appliances, stateful link speed can be 1 Gigabit with a 10 Gigabit data interface, but only non-management ports should be used for the stateful link because management ports have lower performance and cannot meet the performance requirement for stateful failover.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...