Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.


AIP-SSM Module Failover Configuration

I am curious to know if anyone knows how failover works with the AIP-SSM module? Do both SSMs need to be configured with the same address or do I configure a different address for both? Also, should I run a full setup on the failover's SSM or is that information replicated with the stateful failover? Thanks for the help!


Re: AIP-SSM Module Failover Configuration

Cisco ASA 5500 Series appliances can be configured to deny traffic or pass traffic un-inspected in case of a CSC-SSM failure. The Cisco ASAalso supports failover for the CSC-SSM. If the appliance is a member of a failover group, a CSC-SSM failure will trigger a failover to the standbyunit in the pair. Flows that are established and active through the CSC-SSM at the time of failover will have to be re-established.

Re: AIP-SSM Module Failover Configuration

Failover isn't supported by the AIP-SSM so they need to be configured and managed independently (with different IP's). So, yes, you need to run a full setup on both SSM's and make sure you manually keep them both in sync.

When I raised this point with a Cisco engineer I got this response:

"The best thing to do is use IPS MC (CiscoWorks VMS) or better wait for the version with Cisco Security Manager (end of March) and configure an IDS signature policy. You can then ensure that both SSM units have the same IDS signatures so that when the ASA fails over the secondary SSM begins to inspect and enforce the same IPS policy as that on the primary."