Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ASA Failover bandwidth and latency requirements

Hi

Do Cisco have recommendations on minimum bandwidth/latency for the failover and state sync links between active/passive units?

Client wishes to geographically separate primary and secondary units over a layer2 WAN (Ethernet extension service).

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Gold

Re: ASA Failover bandwidth and latency requirements

from the failover documentation:

Failover Interface Speed for Stateful Links

If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.

Use the following failover interface speed guidelines for Cisco PIX security appliances and Cisco ASA adaptive security appliances:

•Cisco ASA 5520/5540/5550 and PIX 515E/535

-The stateful link speed should match the fastest data link

•Cisco ASA 5510 and PIX 525

-Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.

For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than 10 milliseconds, some performance degradation occurs due to retransmission of failover messages.

All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.

1 REPLY
Gold

Re: ASA Failover bandwidth and latency requirements

from the failover documentation:

Failover Interface Speed for Stateful Links

If you use the failover link as the Stateful Failover link, you should use the fastest Ethernet interface available. If you experience performance problems on that interface, consider dedicating a separate interface for the Stateful Failover interface.

Use the following failover interface speed guidelines for Cisco PIX security appliances and Cisco ASA adaptive security appliances:

•Cisco ASA 5520/5540/5550 and PIX 515E/535

-The stateful link speed should match the fastest data link

•Cisco ASA 5510 and PIX 525

-Stateful link speed can be 100 Mbps, even though the data interface can operate at 1 Gigabit due to the CPU speed limitation.

For optimum performance when using long distance LAN failover, the latency for the failover link should be less than 10 milliseconds and no more than 250 milliseconds. If latency is more than 10 milliseconds, some performance degradation occurs due to retransmission of failover messages.

All platforms support sharing of failover heartbeat and stateful link, but we recommend using a separate heartbeat link on systems with high Stateful Failover traffic.

1851
Views
0
Helpful
1
Replies
CreatePlease to create content