Cisco ASA Series Cli Configuration Manual page 277

Chapter 1 Configuring a Cluster of ASAs
Load Balancing
The EtherChannel link is selected using a proprietary hash algorithm, based on source or destination IP
addresses and TCP and UDP port numbers.
Note
On the ASA, do not change the load-balancing algorithm from the default (see the
EtherChannel" section on page
algorithms: source-dest-ip or source-dest-ip-port (see the Nexus OS or IOS port-channel
load-balance command). Do not use a vlan keyword in the load-balance algorithm because it can cause
unevenly distributed traffic to the ASAs in a cluster.
The number of links in the EtherChannel affects load balancing. See the
page 1-7
Symmetric load balancing is not always possible. If you configure NAT, then forward and return packets
will have different IP addresses and/or ports. Return traffic will be sent to a different unit based on the
hash, and the cluster will have to redirect most returning traffic to the correct unit. See the
on page 1-21
EtherChannel Redundancy
The EtherChannel has built-in redundancy. It monitors the line protocol status of all links. If one link
fails, traffic is re-balanced between remaining links. If all links in the EtherChannel fail on a particular
unit, but other units are still active, then the unit is removed from the cluster.
Connecting to a VSS or vPC
You can include multiple interfaces per ASA in the Spanned EtherChannel. Multiple interfaces per ASA
are especially useful for connecting to both switches in a VSS or vPC. Keep in mind that an
EtherChannel can have only 8 active interfaces out of 16 maximum; the remaining 8 interfaces are on
standby in case of link failure. The following figure shows a 4-ASA cluster and an 8-ASA cluster, both
with a total of 16 links in the EtherChannel. The active links are shown as solid lines, while the inactive
links are dotted. cLACP load-balancing can automatically choose the best 8 links to be active in the
EtherChannel. As shown, cLACP helps achieve load balancing at the link level.
1-30). On the switch, we recommend that you use one of the following
for more information.
for more information.
Information About ASA Clustering
"Load Balancing" section on
Cisco ASA Series CLI Configuration Guide
"Customizing the
"NAT" section
1-13