asa active/standby ips

whanson · ‎01-21-2008

If I have two asas in active/standby with ips in each, how does that work, do I need to assign separate ip addresses and then define each separately to MARS

jan.nielsen · ‎01-21-2008

Yes, both IPS modules are actually active, only thing is that the standby ASA doesn't forward any traffic to the module in that unit. So you need to define both modules ip adresses in MARS.

whanson · ‎01-22-2008

Thanks Jan, one other question, I read that there is a performance inpact running ips inline. Do you have any experience on what that impact is...thx again

jan.nielsen · ‎01-24-2008

That depends on how much traffic you are sending to the module in your service-policy, the IPS module is not as fast as the ASA firewall, so you can experience an increase in latency, and also bandwidth will be limited by the IPS module. Check the datasheets for actual numbers.