Step 1

Prepare the template.

1. Clone the github repository to your local folder. See https://github.com/CiscoDevNet/cisco-asav/tree/master/cluster/aws.

2. Modify infrastructure.yaml and deploy_asav_clustering.yaml with the required parameters.

3. Create a file named cluster_layer.zip to provide essential Python libraries to the Lambda functions.

   We recommend to use the Amazon Linux with Python 3.9 installed to create the cluster_layer.zip file.

   Note	If you need an Amazon Linux environment, you can create an EC2 instance using Amazon Linux 2023 AMI or use AWS Cloudshell, which runs the latest version of Amazon Linux.

   For creating the cluster-layer.zip file, you need to first create requirements.txt file that consists of the python library package details and then run the shell script.

   1. Create the requirements.txt file by specifying the python package details.

      The following is the sample package details that you provide in the requirements.txt file:

      $ cat requirements.txt 
      pycryptodome
      paramiko
      requests
      scp
      jsonschema
      cffi
      zipp
      importlib-metadata

   2. Run the following shell script to create cluster_layer.zip file.

      $ pip3 install --platform manylinux2014_x86_64 
      --target=./python/lib/python3.9/site-packages 
      --implementation cp --python-version 3.9 --only-binary=:all: 
      --upgrade -r requirements.txt
      $ zip -r cluster_layer.zip ./python

   Note	If you encounter a dependency conflict error during installation, such as urllib3 or cryptography, it is recommended that you include the conflicting packages along with their recommended versions in the requirements.txt file. After that, you can run the installation again to resolve the conflict.

4. Copy the resulting cluster_layer.zip file to the lambda python files folder.

5. Create the configure_asav_cluster.zip and lifecycle_asav_cluster.zip files

   A make.py file can be found in the cloned repository top directory. This will zip the python files into a Zip file and copy to a target folder.

   python3 make.py build

   Note	Before cluster deployment, ensure that you have customized the AWS CFT template files - infrastructure.yaml and deploy_asav_clustering.yaml for your infrastructure requirement like VPC, Subnets,S3 buckets required for the ASAv clustering autoscale deployment.

Step 2

Deploy infrastructure.yaml and note the output values for the cluster deployment. Before deploying the infrastructure stack, it is important to identify the AWS region and the availability zones that will be used. Each AWS region has a different set of availability zones and VPC infrastructure, therefore it is essential to select the correct region and availability zones for your deployment.

1. On the AWS console, go to CloudFormation and click Create stack; select With new resources(standard).

2. Select Upload a template file, click Choose file, and select infrastructure.yaml from the target folder.

3. Click Next and provide the required information.

4. Enter a unique Cluster Name and Cluster Number for the cluster.

5. Select the availability zone from the Availability Zone list. This field lists only availability zones based on the AWS region that you select for deploying the infrastructure stack using the ClusterFormation template.

6. Enter the predefined subnet CIDR values separated by a comma in the Inside subnet CIDR field.

7. Choose the availability zones required for Lambda to communicate across availability zones from the List of Lambda AZs.

8. Click Next, and then Create stack.

   The CREATE_COMPLETE message indicating the infrastructure stack deployment status is displayed.

9. After the deployment is complete, go to Outputs and note the S3 BucketName.

Step 3

Upload cluster_layer.zip, configure_asav_cluster.zip, and lifecycle_asav_cluster.zip to the S3 bucket created by infrastructure.yaml.

Step 4

Deploy deploy_asav_clustering.yaml:

1. Go to CloudFormation, click Create stack, and select With new resources(standard).

2. Click Upload a template file, and Choose file, and select deploy_asav_clustering.yaml from the target folder.

3. Click Next and provide the required information.

4. Provide the following cluster and infrastructure configuration information.

   Parameter	Allowed Values/Type	Description
   Cluster Configuration
   Cluster Name	String	This is the cluster name Prefix. The cluster number will be added as a suffix.
   Cluster Number	String	This is the cluster number. This will be suffixed to the cluster name (msa-asa-infra). For example, if this value is 1, the group name will be msa-asa-infra-1. It should be at least 1 digit, but not more than 3 digits. Default: 1.
   Cluster Size	Numbers	This is the total number of ASA virtual nodes in a cluster. Minimum: 1 Maximum:16
   Infrastructure Details
   Number of Availability Zones	String	This is the total number of availability zones into which ASA virtual is deployed. (The number of availability zones varies from a Minimum 1 to Maximum 3 depending on a region). The subnet will be created in these availability zones. The availability zones available in this list is based on the region selected for deploying the cluster. Note   Lambda is created across two availability zones. Management and Inside subnet are created across three availability zones based on this parameters.
   Enter Valid Availability Zone List	String	The availability zone list is based on the region you plan to deploy. In Availability Zone list, select the valid availability zone (1 availability zone or 2 availability zones or 3 availability zones). Count should match with the value of Number of Availability Zones parameter.
   Cluster Email Notifications	String	Email address to which Cluster Events email will be sent. You must accept a subscription email request to receive this email notification. Example:admin@company.com
   GWLB Configuration
   Deploy GWLB Endpoint	String	Click Yes to deploy the GWLB enpoint. By default,the value is set to No.
   VPC ID for GWLBE	String	Enter VPC to deploy Gateway Load Balancer Endpoint. Note   Do not enter any value in this field if you are not deploying the GWLB endpoint.
   Subnet ID for GWLBE	String	Enter only one subnet ID. Note   Do not enter any value in this field if you are not deploying the GWLB endpoint. Ensure that the subnet belongs to the correct VPC, and the availability zones that you have specified.
   Target Failover	String	Enable Target Failover support when a target fails or deregisters. (By default, the value of this parameter is set to rebalance). no_rebalance: Directs existing flows to failed targets and new flows to healthy targets, ensuring backward compatibility. rebalance: Redistributes existing flows while ensuring that new flows go to healthy targets.
   Enter Health Check Port for GWLB	String	Enter Health Check Port for GWLB. Note   By default, this port must not be used for traffic. Ensure the value you provide is a valid TCP port. Default: 80
   Cisco ASAv Instance Configuration
   ASAv Instance type	String	Cisco ASAv EC2 instance type. Ensure that the AWS Region supports Instance Type you select. By default, c5.xlarge is selected.
   ASAv Instance License type	String	Choose Cisco ASAv EC2 instance license type. Ensure that the AMI ID that you enter in AMI-ID parameter is of the same licensing type. By default, BYOL is selected.
   ASAv smart software license token	String	(Optional) Provide the Cisco Smart Software License token for registration of ASAv devices.
   ASAv AMI-ID	String	Choose the correct AMI ID as per the region, version, and license type (BYOL or PAYG). ASAv Version 9.19 and later support clustering, and ASAv Version 9.22 and later support the autoscaling and multi-AZ enhancements. Type: AWS::EC2::Image::Id By default: ami-024f546cb9cbae1bb
   ASAv Password	String	ASAv instance password. The password is activated after ASAv is accessible. Minimum length must be 8 characters. The password can either be a plain text password or a KMS encrypted password.
   Cpu Threshold	CommaDelimitedList	(Optional) Specifying non-zero lower and upper thresholds will create scale policies. If (0,0) is selected, no CPU scaling alarm or policies will be created. Evaluation points and data points are at default or recommended values. By default, Autoscale is enabled in this template. Autoscale can be disabled after deployment.

5. Click Next.

6. Click to acknowledge all the AWS CloudFormation options.

7. Click Submit to deploy the cluster.

8. Click Next, and then Create Stack.

Step 5

Verify the cluster deployment by logging in to any one of the nodes and entering the show cluster info command:

show cluster info 

Cluster oneclicktest-cluster: On
Interface mode: individual
Cluster Member Limit : 16
This is "200" in state CONTROL_NODE
ID : 0
Version : 9.19.1
Serial No.: 9AU42EN5D1E
CCL IP : 1.1.1.200
CCL MAC : 4201.0a0a.0fc7
Module : ASAv
Resource : 4 cores / 8192 MB RAM
Last join : 15:26:22 UTC Jul 17 2022
Last leave: N/A
Other members in the cluster:
Unit "204" in state DATA_NODE
ID : 1
Version : 9.19.1
Serial No.: 9AJ9N46947R
CCL IP : 1.1.1.204
CCL MAC : 4201.0a0a.0fcb
Module : ASAv
Resource : 4 cores / 8192 MB RAM
Last join : 16:57:42 UTC Jul 17 2022
Last leave: 16:03:25 UTC Jul 17 2022

Step 1

Prepare the template.

1. Clone the GitHub repository to your local folder. See https://github.com/CiscoDevNet/cisco-asav/tree/master/cluster/azure.

2. For GWLB, modify azure_asav_gwlb_cluster.json and asav-gwlb-cluster-config.txt with the required parameters.

Step 2

Log into the Azure portal: https://portal.azure.com.

Step 3

Create a Resource group.

Step 4

Create a virtual network with three subnets: Management, Outside, and Cluster Control Link (CCL) for your ASAv cluster.

Step 5

Add the subnets.

Step 6

Deploy the Custom template.

1. Click Create > > Template deployment (deploy using custom templates).

2. Click Build your template in the editor.

3. Click Load File and upload the azure_asav_gwlb_cluster.json.

4. Click Save.

Step 7

Configure the Instance details.

Step 8

Enter the required values and then click Review + create.

Step 9

Click Create after the validation is passed.

Step 10

After the instance runs, verify the cluster deployment by logging into any of the nodes and entering the show cluster info command.

Step 1

Log in to the Microsoft Azure portal (https://portal.azure.com) using your Microsoft account username and password.

Step 2

Click Resource groups from the menu of services to access the Resource Groups blade. You will see all the resource groups in your subscription listed in the blade. Create a new resource group or select an existing, empty resource group. For example,secure-firewall-asav-demo.

Step 3

Click Create a resource (+) to create a new resource for template deployment. The Create Resource Group blade appears.

Step 4

Click Virtual Network from the menu of services to access the Virtual network blade. Create a virtual network with subnets.

Step 5

In Search the Marketplace, type Template deployment (deploy using custom templates), and then press Enter.

Step 6

Click Create. There are several options for creating a template. Choose Build your own template in editor.

Step 7

In the Edit template window, delete all the default content and copy the contents from the updated azure_asav_gwlb_cluster_custom_image.json or azure_asav_nlb_cluster_custom_image.json (depending on the type of autoscale solution you are deploying on Azure) and click Save. Or Click Load file to browse and upload this file from your computer.

Step 8

In the parameter field sections, fill all the parameters. Refer to Input Parameters for details about each parameter, then click Review+Create.

Step 9

When a template deployment is successful, it creates all the required resources for the ASA Virtual auto scale for Azure solution. The Type column describes each resource, including the Logic App, VMSS, Load Balancers, Public IP address, etc.

Step 1

On your local computer, go to the target folder and run the following command to deploy the Azure cluster autoscale function to the function app.

az functionapp deployment source config-zip -g <Resource Group Name> -n <Function App Name> --src  <cluster_functions.zip> --build-remote true

Step 2

Verify successful deployment of the functions by checking if the uploaded functions are visible in the Overview section of the function app as shown below.

Step 1

From the repository, retrieve the file LogicApp.txt to the local system and edit as shown below.

1. Find and replace all the occurrences of “SUBSCRIPTION_ID” with your subscription ID information.

2. Find and replace all the occurrences of “RG_NAME” with your resource group name.

3. Find and replace all of the occurrences of “FUNCTIONAPPNAME” to your function app name.

   The following example shows a few of these lines in the LogicApp.txt file:

   
     "AutoScaleManager": {
         "inputs": {
             "function": {
                 "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME/providers/Microsoft.Web/sites/FUNCTIONAPPNAME/functions/AutoScaleManager"
             }
   .
   .
                         },
                         "Deploy_Changes_to_ASA": {
                             "inputs": {
                                 "body": "@body('AutoScaleManager')",
                                 "function": {
                                     "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME/providers/Microsoft.Web/sites/FUNCTIONAPPNAME/functions/DeployConfiguration"
                                 }
   .
   .
                         "DeviceDeRegister": {
                             "inputs": {
                                 "body": "@body('AutoScaleManager')",
                                 "function": {
                                     "id": "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME/providers/Microsoft.Web/sites/FUNCTIONAPPNAME/functions/DeviceDeRegister"
                                 }
                             },
                             "runAfter": {
                                 "Delay_For_connection_Draining": [
   
   

4. (Optional) Edit the trigger interval, or leave the default value (5). This is the time interval at which the Autoscale functionality is periodically triggered. The following example shows these lines in the LogicApp.txt file:

   
           "triggers": {
               "Recurrence": {
                   "conditions": [],
                   "inputs": {},
                   "recurrence": {
                       "frequency": "Minute",
                       "interval": 5
                   },
   
   

5. (Optional) Edit the time to drain, or leave the default value (5). This is the time interval to drain existing connections from the ASA virtual before deleting the device during the Scale-In operation. The following example shows these lines in the LogicApp.txt file:

   
            "actions": {
                 "Branch_based_on_Scale-In_or_Scale-Out_condition": {
                     "actions": {
                         "Delay_For_connection_Draining": {
                             "inputs": {
                                 "interval": {
                                     "count": 5,
                                     "unit": "Minute"
                                 }
   
   

6. (Optional) Edit the cool down time, or leave the default value (10). This is the time to perform NO ACTION after the Scale-Out is complete. The following example shows these lines in the LogicApp.txt file:

   
                    "actions": {
                        "Branch_based_on_Scale-Out_or_Invalid_condition": {
                            "actions": {
                                "Cooldown_time": {
                                    "inputs": {
                                        "interval": {
                                            "count": 10,
                                            "unit": "Second"
                                     }
   
   

Step 2

Go to the Logic App code view, delete the default contents and paste the contents from the edited LogicApp.txt file, and click Save.

Step 3

When you save the Logic App, it is in a 'Disabled' state. Click Enable when you want to start the Auto Scale Manager.

Step 4

Once enabled, the tasks start running. Click the 'Running' status to see the activity.

Step 5

Once the Logic App starts, all the deployment-related steps are complete.

Step 6

Verify in the VMSS that ASA virtual instances are being created.

Step 1

Enter cluster configuration mode:

Step 2

(Optional) Enable console replication from data nodes to the control node:

Step 3

Set the minimum trace level for clustering events:

Step 4

Set the keepalive interval for flow state refresh messages (clu_keepalive and clu_update messages) from the flow owner to the director and backup owner.

Step 1

Enter cluster configuration mode.

ciscoasa(config)# cluster group test
ciscoasa(cfg-cluster)#

Step 2

Customize the cluster node health check feature.

ciscoasa(cfg-cluster)# health-check holdtime 5

Step 3

Disable the interface health check on an interface.

ciscoasa(cfg-cluster)# no health-check monitor-interface management1/1

Step 4

Customize the auto-rejoin cluster settings after a health check failure.

ciscoasa(cfg-cluster)# health-check data-interface auto-rejoin 10 3 3

Step 5

Configure the debounce time before the ASA considers an interface to be failed and the node is removed from the cluster.

ciscoasa(cfg-cluster)# health-check monitor-interface debounce-time 300

Step 6

(Optional) Configure traffic load monitoring.

ciscoasa(cfg-cluster)# load-monitor frequency 50 intervals 25
ciscoasa(cfg-cluster)# show cluster info load-monitor
ID  Unit Name
0  B
1  A_1
Information from all units with 50 second interval:
Unit     Connections    Buffer Drops   Memory Used   CPU Used
Average from last 1 interval:
   0           0            0            14              25
   1           0            0            16              20
Average from last 25 interval:
   0           0            0            12              28
   1           0            0            13              27

Step 1

Enter cluster configuration mode:

ciscoasa(config)# cluster group pod1

Step 2

Disable clustering:

Remove the node from the cluster.

ciscoasa(config)# cluster remove unit ?

Current active units in the cluster:
asa2

ciscoasa(config)# cluster remove unit asa2
WARNING: Clustering will be disabled on unit asa2. To bring it back
to the cluster please logon to that unit and re-enable clustering

Step 1

At the console, enter cluster configuration mode:

ciscoasa(config)# cluster group pod1

Step 2

Enable clustering.

Step 1

For a data node, disable clustering:

ciscoasa(config)# cluster group cluster1
ciscoasa(cfg-cluster)# no enable

Step 2

Clear the cluster configuration:

Step 3

Disable cluster interface mode:

Step 4

If you have a backup configuration, copy the backup configuration to the running configuration:

ciscoasa(config)# copy backup_cluster.cfg running-config

Source filename [backup_cluster.cfg]?

Destination filename [running-config]?
ciscoasa(config)#

Step 5

Save the configuration to startup:

Step 6

If you do not have a backup configuration, reconfigure management access. Be sure to change the interface IP addresses, and restore the correct hostname, for example.

Set a new node as the control node:

ciscoasa(config)# cluster control-node unit asa2

Send a command to all nodes, or if you specify the node name, a specific node:

ciscoasa# cluster exec show xlate