AIP-SSM Module Failover Configuration

[jwalker]

I am curious to know if anyone knows how failover works with the AIP-SSM module? Do both SSMs need to be configured with the same address or do I configure a different address for both? Also, should I run a full setup on the failover's SSM or is that information replicated with the stateful failover? Thanks for the help!

[mchin345]

Cisco ASA 5500 Series appliances can be configured to deny traffic or pass traffic un-inspected in case of a CSC-SSM failure. The Cisco ASAalso supports failover for the CSC-SSM. If the appliance is a member of a failover group, a CSC-SSM failure will trigger a failover to the standbyunit in the pair. Flows that are established and active through the CSC-SSM at the time of failover will have to be re-established.

[andrew.burns]

Failover isn't supported by the AIP-SSM so they need to be configured and managed independently (with different IP's). So, yes, you need to run a full setup on both SSM's and make sure you manually keep them both in sync.

When I raised this point with a Cisco engineer I got this response:

"The best thing to do is use IPS MC (CiscoWorks VMS) or better wait for the version with Cisco Security Manager (end of March) and configure an IDS signature policy. You can then ensure that both SSM units have the same IDS signatures so that when the ASA fails over the secondary SSM begins to inspect and enforce the same IPS policy as that on the primary."

HTH

Andrew.