ASA firewall cause outraged....maintaining QOS in architecture ......(or)Cisco ASA in active / active mode, how to pass almost like stateful info across to the other member?

The correct answer is D. ASR groups. In ASA active/active failover, both units are simultaneously active for different failover groups/contexts. A problem arises with asymmetric routing - traffic may enter one ASA unit but return through the other. Without a mechanism to share connection state, the returning unit…

Security Services

Question

Options

AECMP
BBFD
CIP SLA
DASR groups

How the community answered

(36 responses)

A
3% (1)
B
11% (4)
C
3% (1)
D
83% (30)

Explanation

In ASA active/active failover, both units are simultaneously active for different failover groups/contexts. A problem arises with asymmetric routing - traffic may enter one ASA unit but return through the other. Without a mechanism to share connection state, the returning unit would have no knowledge of the session and would drop the packets. ASR (Asymmetric routing) groups solve this: interfaces on both units are assigned to the same ASR group, and when a packet arrives that belongs to a connection owned by the peer unit, the receiving unit forwards that packet over the stateful link to the owning unit for proper processing. This allows stateful session information to be effectively shared between active/active members even when traffic flows asymmetrically.

Topics

#ASA active/active#stateful failover#ASR groups#high availability

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice