ASA5585-SSP-IPS60 high availability question

[Bela Mareczky]

Dear Forum!

I would like to ask You for a quick help regarding ASA5585-SSP-IPS60 high availability:

Does anybody have experience with IPS60 SSM module in ASA5585 if shutting down the IPS module with the "hw-module module 1 shutdown" command has any impact of the ASA redundancy group?

So for example, if I issue the "hw-module module 1 shutdown" for the IPS SSM module on an ASA which has an active redundancy group running on it, can I expect failover to the another ASA node because of the shutdown status of the IPS module?

Many thanks in advance!

Best Regards,

Belabacsi

[Marvin Rhoads]

Do you mean a failover group? I'm not familiar with the term redundancy group for ASAs.

In a failover group (HA pair), both units' hardware modules need to be Up for the unit to be marked as healthy (Active for the primary or Ready in the case of the standby) if (and only if) a service policy is configured to redirect traffic to them.

If you have an HA pair and the standby unit's IPS module is Down and then the primary unit's IPS module fails, it will remain Primary Active - albeit without functioning IPS.