ASA options for FW and IPS with High Availability

[nkariyawasam]

Question 1:

-----------

I am looking for IPS solution for customer and checking the following ASA part number;

ASA5540-AIP20-K9

(ASA 5540 Appliance w/ AIP-SSM-20, SW, HA, 4GE+1FE, 3DES/AES)

What does the HA means here - is it only the software ?

In that case do we have to buy a second unit ( at the same price) for failover ?

( I was wondering whether ASA also has a cost -effective failover solution like PIX had - a reduced price for the failover unit ).

If I select the ASA VPN edition is there any way to add IPS module in it ?

[a.kiprawih · Accepted solution]

Hi,

Q: What does the HA means here - is it only the software ? In that case do we have to buy a second unit ( at the same price) for failover ?

The "ASA5540-AIP20-K9" is only for 1 unit of ASA, with HA (active/active,active/standby) software feature. You have to add/buy another unit to achieve HA/recundancy.

I think the price for all unit is still the same, as ASA does not have unit to purposely do the FO function.

Q: If I select the ASA VPN edition is there any way to add IPS module in it ?

Extensive Malware Mitigation & Intrusion Prevention is included, as mentioned in "Table 3. Network Security at the VPN Gateway" in:

http://www.cisco.com/en/US/products/ps6120/products_data_sheet0900aecd80402e3f.html

Rgds,

AK