Charm -
The Cisco IPS sensors do not support failover in the same way a firewall does. They do not maintain any sort of synchronization between the sensors. The IPS sensors operate independently. If a TCP session is in progress with it's traffic passing thru one IPS sensor when a failover occurs, the secondary ASA's IPS Sensor will not know the state of that TCP session, since it did not see it being created. This will lead to some loss of signature detection for sessions in place when a failover occurs.
You will need to manually make sure both sensors have the same configuration, with the exception of the sensor's management IP address.
- Bob
