Reimage AIS SSM20 on secondary firewall

[pskipton01]

I have two firewalls asa 5520 each has AIP-SSM

20. I need to reimage the IPS on the secondary firewall

.

To avoid a failover do I need to shut off the SSM on the primary firewall. Do I need to turn off failover? What would be the way to do this to not disturbe the primary firewall?

[cvilleme]

Hi Perry,

I am assuming that you have an active/standby ASA failover configuration, is that correct?  Instead of the terms 'primary' and 'secondary', it's better to refer to the current failover state of each firewall, i.e., 'active' and 'standby', since it is those states that determine what fails over to what.  If you are reimaging the AIP-SSM-20 in the standby ASA, then that won't impact the active ASA.  You would only impact the active ASA if you were reimaging the AIP-SSM-20 in the active ASA.

Let's assume that you needed to upgrade or reimage or reboot the AIP-SSM-20 in the active ASA within an active/standby failover deployment and did not want to trigger an ASA failover.  In that case, you have the two options you mention -- Option #1) first shutdown the AIP-SSM-20 in the standby ASA and then perform the reimage of the module in the active ASA, or Option #2) temporarily disable failover, reimage the AIP-SSM-20, and then re-enable failover.

Regards,
Chris