Poor failover performance of WS-SVC-ASA-SM1 in WS6506-E

Hello, I am trying to deploy an active/active multi-context solution using the hardware noted above.

I believe I have done all required to get this working however I am still seeing fail over times of

around 50 seconds.

The ASAs blades and the supervisors have identical images:-

Cisco Adaptive Security Appliance Software Version 9.1(2) <context>
Device Manager Version 6.5(1)
Compiled on Thu 09-May-13 16:20 PDT by builders
Hendon up 17 days 21 hours
failover cluster up 26 days 21 hours
Hardware:   WS-SVC-ASA-SM1

Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9-M), Version 15.1(2)SY4a, RELEASE SOFTWARE (fc1)

I have this config on both the 6506 supers:-

firewall autostate
firewall multiple-vlan-interfaces
firewall module 6 vlan-group 56
firewall vlan-group 56  12,41-44,51-54,56-60,68,69,72,73,76,77,88,97-99,199,858,860,2009,2012,2041
firewall vlan-group 56  2051,2053,2054,2057,2060,2076,2077,2088,2098,2099,2142,2152,2156,2158,2159
firewall vlan-group 56  2188,2197,2199

I can paste in further content on request. Any help would be much appreciated.

Many thanks
Simon FitzgeraldAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JustInCaseCommented:
First thing that I think of when I hear about forwarding delay about 50 second is: Are you using STP in your network? That sounds like forwarding delay caused by STP convergence.

30 seconds - Listening + Learning
20 seconds - Max Age
Simon FitzgeraldAuthor Commented:
Thanks for your quick response Predrag. Yes we are using spanning tree. I have a 4500
used for connecting 'users' to vlan 2060 and that 4500 has two links, one to each of the 6506 switches on vlan 2060.

Having said that now it is of course the 4500 that is taking the time to fail over..but i can't turn if off due the loop....thinking we should enable rapid spanning tree....will give that a go and let you know. Thanks

Thanks again
Simon FitzgeraldAuthor Commented:
Hello Predrag, I enabled rpst and 'failover autostate' and all is much quicker now, thanks for that.

Would you advise disabling spanning tree altogether on the access switches and leave it running on  the two 6506s which contain the ASA SMs ?

Thanks
Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

JustInCaseCommented:
No.
:)
You should run STP on access switches, but you can set portfast with bpdu guard on ports where edge device are expected.
#interface range fa0/1-20
# spanning-tree portfast bpduguard

However, if you disable spanning tree on links between ASA and 6506s switches, and configure L3 links with some dynamic routing, especially if you use equal cost links. If you configure EIGRP on devices along with equal cost multiple L3 links - it would load balance traffic through equal cost links and if one link is down it will simply continue to forward traffic through link that is currently "up and running" and there should be no downtime at all (at least on links between switches and ASAs).

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Simon FitzgeraldAuthor Commented:
Hello Predrag, sorry for the delay...thanks for your answer.
JustInCaseCommented:
No problem...
You're welcome.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.