Add FW IP in ACS 5.4

[johnlloyd_13]

hi,

just a quick one, if adding an ASA active-standby FW in ACS 5.4, do i just create a single entry?

meaning I only add a device using the 'active' IP address?

[Marvin Rhoads]

It depends.

If you ever expect to log into the standby unit, then you will need to add the source IP it will be using to communicate to your ACS server. This could be a standby IP address on you inside interface, the management address etc. - depending on how your system is setup. 

We seldom need to log into the standby unit directly, but when we do it's generally for something important. So it's good to have the capability covered in your AAA implementation. 

[johnlloyd_13]

hi marvin,

i just want to lock down ASA devices by the ACS policy where you can't execute service impacting commands, like 'reload', 'write erase' etc.

i would just add the 'standby' IP just to make sure both A/S FW pair are covered.