ips failover

[mirehteshamali]

hi all

i have recently designed a solution having  firewall failover in active standby mode .

now i need to add ips in inline mode. with failover capability .

1) is their any failover of ips 4210 ? further how many signatures does 4210 supports ..

2) is CSC card a substitue of IPS card on ASA ?

3 )Will CSC ---asa---4210ips --------inside network , slow down due to repeated scanning at various levels ??

thanks

[andrey.dugin · Accepted solution]

I'll try to answer.

1) As I know there were no failover features in Cisco IPS.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/white_paper_c11-459025.html

According to the document IPS has no additional influence on traffic in firewall failover situations but IPS cannot be clustered.

You can configure fail-open hardware bypass feature for IPS to permit traffic through it when IPS fails or use fail-close feature to stop traffic when IPS fails.

2) CSC is not 100% substitute for IPS.

3) It depends on your network.