Two SSM-10 IPS Modules needed for HA-Pair 5520 or can I use one with and one without?

[Dean Romanelli]

Tried this in the firewall section but no one knew the answer. Figured I'd ask here next.

I have two 5520's. One in production with an IPS SSM-10 installed, and one in storage.  All parameters are identical except I don't have an SSM-10 for the storage 5520.

Can I still HA pair that storage 5520 to the production 5520 if I don't have an IPS module in the standby unit but I do have one in the active unit or will it not work? The IPS's have to be configured manually - meaning that replication to mate does not take care of the IPS so I would think no, but not sure. 

[Karsten Iwen · Accepted solution]

Both devices have to be identically. WIth the SSM-10 being EOL and without any signature-updates, I would remove the module from the first ASA and operate both without.

But remember that the ASA 5520 is also EOL and should be replaced soon.

[Dean Romanelli]

Thanks Karsten.  So just to confirm:  It's either both with IPS or both without right?

Cannot run one with and one without in HA pair even though config sync doesn't replicate between them like running-conf of the ASA itself does right? 

[Karsten Iwen]

At least, it's not a supported configuration. And from an HA-perspective the second unit without the module would always be in a failed state.

[Dean Romanelli]

Thank you Sir.

A follow up question:

My storage 5520 has no config on it or on the IPS. When I console into the 5520 and do "session 1" it says the module in slot 1 did not respond and it's state is "unresponsive."

Do I need to do something before I can session to it with a blank config, connected via console connection or should that work?