ASA Active Standby and IPS Configure

[prashantrecon]

Hi All,

I have two ASA 5520 version 8.2 in active Standay Mode.

What is a good practice to setup IPS AIM ssm-20 for this setup.

Is IPS should be in Fail-Open or Fail-Close mode ?

Is Mangement ip for both IPS module should be same or diffrent. ?

[jocamare]

You might find this useful:

http://www.cisco.com/en/US/docs/security/asa/quick_start/ips/ips_qsg.html

Answering your questions:

Is IPS should be in Fail-Open or Fail-Close mode ?

Depends, most setups have it on fail-open mode, so in case the module fails or goes down the traffic will still flow across the ASA.

When working on a fail-close mode, it might be because you don't want any traffic to go out of your network without inspection since this might represent a secuirty threat to your or other users.

Is Mangement ip for both IPS module should be same or diffrent. ?

The modules are separate and software independent modules, which means they need their own IP address for management. Each module should have its own IP address.

[prashantrecon]

Thanks for the answer.

We have configured failover in active standby mode.

so if primary aip card fails(say it is rebooted)  than secoundary firewall will become active right .

I have configured for lan as well as state failover

So in this case failopen is of no use.?

If i keep it in failclose state close if the card fails in primary than secoundary will become active.

so atleast in this case the traffic will get inspected?

[jocamare]

If the module on the active unit goes down, failover it's not going to trigger.

The feature doesn't monitor the status of the modules.

Now, fail-open/close has nothing to do with failover.

It's a local feature that allow the traffic to pass or be denied depending on the status of the locally installed IPS module.

[prashantrecon]

Hi,

Thanks for reply

but if  iam restarting the primary firewall ips modules my failover is triggering...

My primary firewall become standby in this condtion and Standby become active 

why this is happning....?

[jocamare]

Last time i checked on my lab [a couple a months ago] the status of the modules had nothing to do with the status of the unit on failover.

The following link describes the possible triggers for A/S failover:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ha_active_standby.html#wp1079547

It doesn't mention anything about the modules.

I'm not sure why this is happening though, there have been several cases with the same exact behavior, so this seems to be something normal but it's not properly dodcumented.

[prashantrecon]

Thanks for reply