cisco ASA fail-open with "no monitor-interface service-module"

[hamidreza.taghipur]

Hi

In the ASA with firepower module, can we use fail-open command with "no monitor-interface service-module" ?
Can it still detect fail status of firepower module with "no monitor-interface service-module"

[AViftrup · Accepted solution]

fail-open - means if module is down, it will forward traffic regardless of configured rules.

no monitor-interface service-module - This is only related to high-availability, executing this command means IF the SFR module is down, it will not failover to standby unit if this is the only condition to trigger.

Both commands can operate along each other, but keep in mind they have different use-cases.

[hamidreza.taghipur]

thanks alot for attention .

[Marvin Rhoads · Accepted solution]

In addition to what @AViftrup correctly noted, the ASA will still see the status of the module even with "no monitor-interface service-module", it just won't trigger a failover event when the status changes to "failed". It will generate a syslog message whenever module status changes (assuming you haven't disabled logging).

[hamidreza.taghipur]

thanks alot for explanation