Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Dual IDSM and dual FWSM

I have two 65XX core switches in HSRP config. Both switches has FWSMs configured in Active and failover mode.

Both the switches has IDSM-2 as well. IDSM-2 in active switch will do the traffice analysis. It is supposed to change-over during failure of active core switch.

In active IDSM-2, active FWSM has been configured as a blocking device.

Can the IDSM-2 in standby switch also configre the same active FSWM unit ? ( In this case both IDSMs controlls the same FWSM.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Dual IDSM and dual FWSM

No, you should not configure 2 sensors to control the same firewall (or router or switch).

The 2 sensors will wind fighting for control of the firewall and remove each other's block commands in some situations.

So you have 2 choices.

1) Configure each IDSM-2 to only control it's associated FWSM.

or

2) Configure one IDSM-2 as the Master Blocking sensor and the other IDSM-2 as the Block Forwarding sensor. The Master Blocking sensor will control both FWSMs. You will lose all Blocking if te Master Blocking sensor goes down for some reason. There is no "failover" mechanism for the other IDSM-2 to take over.

1 REPLY
Cisco Employee

Re: Dual IDSM and dual FWSM

No, you should not configure 2 sensors to control the same firewall (or router or switch).

The 2 sensors will wind fighting for control of the firewall and remove each other's block commands in some situations.

So you have 2 choices.

1) Configure each IDSM-2 to only control it's associated FWSM.

or

2) Configure one IDSM-2 as the Master Blocking sensor and the other IDSM-2 as the Block Forwarding sensor. The Master Blocking sensor will control both FWSMs. You will lose all Blocking if te Master Blocking sensor goes down for some reason. There is no "failover" mechanism for the other IDSM-2 to take over.

185
Views
0
Helpful
1
Replies
CreatePlease to create content