02-15-2006 01:02 PM - edited 03-10-2019 01:53 AM
I am curious to know if anyone knows how failover works with the AIP-SSM module? Do both SSMs need to be configured with the same address or do I configure a different address for both? Also, should I run a full setup on the failover's SSM or is that information replicated with the stateful failover? Thanks for the help!
02-21-2006 01:26 PM
Cisco ASA 5500 Series appliances can be configured to deny traffic or pass traffic un-inspected in case of a CSC-SSM failure. The Cisco ASAalso supports failover for the CSC-SSM. If the appliance is a member of a failover group, a CSC-SSM failure will trigger a failover to the standbyunit in the pair. Flows that are established and active through the CSC-SSM at the time of failover will have to be re-established.
03-14-2006 03:46 AM
Failover isn't supported by the AIP-SSM so they need to be configured and managed independently (with different IP's). So, yes, you need to run a full setup on both SSM's and make sure you manually keep them both in sync.
When I raised this point with a Cisco engineer I got this response:
"The best thing to do is use IPS MC (CiscoWorks VMS) or better wait for the version with Cisco Security Manager (end of March) and configure an IDS signature policy. You can then ensure that both SSM units have the same IDS signatures so that when the ASA fails over the secondary SSM begins to inspect and enforce the same IPS policy as that on the primary."
HTH
Andrew.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide