Let's assume a basic setup for your ASA-5520s where you have 1 outside interface, 1 inside interface, and 1 dmz interface per ASA and the 2 ASAs are configured for active/standby.
So you have a total of 3 networks connected to your ASAs.
The next decision is which of the 3 networks you want to monitor, and how you want them monitored.
Let's make the assumption that you want to monitor the connection to the External network and you want to do Inline monitoring (instead of promiscuous).
You will want to place your IPS sensor between your ASA and the external network connection.
Let's assume you have a router as your internet connection, and the router is connected to a switch, and both ASA's external interfaces are connected to the switch.
Options:
Take an IPS-4240 and place it between both ASAs and the switch.
You would create 2 inline interface pairs. You would place one of the inline interface pairs between the active ASA and the switch, and the other inline interface pair between the standby ASA and the switch.
The problem, however, is that if the IPS-4240 goes down, then it is a single point of failure and you lose internet connectivity.
So what is the next option:
If you only want to purchase a single IPS-4240 and are willing to live without monitoring in case of failure of the IPS, then there are 2 methods to try.
You could purchase 2 Hardware ByPass Switches. You would put a HW Bypass Switch between the active ASA and the switch, and the second HW ByPass switch between the standby ASA and the switch.
You then hook up the inline interface pairs of the IPS-4240 to the monitoring ports of the HE ByPass Switches.
So long as the IPS-4240 is functioning, the HW ByPass Switches will force the traffic to flow through the sensor for inline monitoring. If for some reason the IPS-4240 stops passing traffic (loss of power, or a crash), then the HW ByPass Switches automatically ByPass the IPS-4240 and the traffic passes straight from the ASAs to the switch without being analyzed by the sensor. This option works well when funds are limited, or when IPS analysis is a nice to have and not a hard requirement.
Another method is to change from using Inline Interface Pairs to using an InLine Vlan Pair, and using a Wire as a failover unit.
In this scenario the ASAs get directly connected to the switch. But they are put into a NEW vlan separate from the Internet Router.
The IPS-4240 has a single interface connected to the switch.
The switch is configured to trunk both the ASA vlan and the Internet Router vlan to the sensor.
The sensor is configured to PAIR the 2 vlans (an Inline Vlan Pair on the single sensor interface). So now traffic coming from the ASA gets analyzed as passed to the router, and traffic from the router gets analyzed then passed to the ASA.
As the failover mechanism you now connect a physical wire into 2 ports of the switch. One port on the ASA vlan, and the other port on the router vlan.
And configure spanning-tree on the switch to prefer the IPS Sensor port. If the IPS sensor goes down, then spanning-tree will fall back to using the wire to pass the traffic between the vlans (no IPS analysis).
Now if you can afford 2 IPS-4240 sensors then you can instead setup failover between the 2 sensors.
Follow the same setup as above for a single IPS-4240 in InLine Vlan Pair mode, and just repeat it for a second IPS-4240.
Spanning-tree will pick one as the primary and put in a Forwarding State. The other it will put into a Blocking state. If the first one fails, then the second one will change from a Blocking state to a Forwarding state and start monitoring traffic.
So why an IPS-4240?
It is the closest appliance to the same performance level as an ASA 5520.
