topic Re: ASA 5510 IPS Edition Bundle high availability in Network Security https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986807#M80122 <HTML><HEAD></HEAD><BODY><P>So if we order ASA5510-AIP10-K9 then does it has needed license for high availability also ? </P><P></P></BODY></HTML> Tue, 06 May 2008 05:27:00 GMT MortezaSoltani 2008-05-06T05:27:00Z ASA 5510 IPS Edition Bundle high availability https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986805#M80119 <P>Hi</P><P>we intend to use asa5510 ips edition as firewall and ips ,anybody know if asa 5510 ips edition support high availability also ?</P><P></P><P>regard</P> Sun, 10 Mar 2019 11:05:38 GMT https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986805#M80119 MortezaSoltani 2019-03-10T11:05:38Z Re: ASA 5510 IPS Edition Bundle high availability https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986806#M80120 <HTML><HEAD></HEAD><BODY><P>The ASA 5510 itself supports high availablity which includes both keeping the configuration of the 2 ASA's in sync, and failing over traffic to the other ASA.</P><P></P><P>The SSM-10 does not technically support high availability itself, but will function just fine in ASA's that support high availability.</P><P>The SSM-10s will not sync their configuration so each SSM-10 needs it's own ip address and must be independantly configured. (Some users use CSM to manage the IPS configuration so they can make a single change and apply that config change to both of the SSM-10s).</P><P></P><P>The SSM-10s will not share monitoring information, but will not stop a session that fails over from one ASA to the other.</P><P>The SSM-10 relies on the ASA to track session state and validate that the packet is legitimate. So if a session is being monitored by one SSM-10 and that ASA fails, then the session fails over to the second ASA, and the SSM-10 in the second ASA starts seeing the packets for that session. That second SSM-10 will assume that the ASA has validated that the session should be allowed, so the SSM-10 simply starts monitoring that connection from the point in which it failed over to the second ASA.</P><P>It does not stop the connection (unless it sees an attack in the connection).</P><P></P><P></P></BODY></HTML> Tue, 06 May 2008 04:56:26 GMT https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986806#M80120 marcabal 2008-05-06T04:56:26Z Re: ASA 5510 IPS Edition Bundle high availability https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986807#M80122 <HTML><HEAD></HEAD><BODY><P>So if we order ASA5510-AIP10-K9 then does it has needed license for high availability also ? </P><P></P></BODY></HTML> Tue, 06 May 2008 05:27:00 GMT https://community.cisco.com/t5/network-security/asa-5510-ips-edition-bundle-high-availability/m-p/986807#M80122 MortezaSoltani 2008-05-06T05:27:00Z