AIP-SSM 20 Throughput

Hi,
We are in process of installing the AIP-SSM20 modules in ASA5520 (Active/passive). Currently its configured in promiscuous mode /w monitoring all the outside and dmz traffic... I have also tuned various signature to troubleshoot and increase the AIP-SSM20 throughput but I am seeing below messages randomly throughout the day:
evStatus: eventId=1218593040808071564 vendor=Cisco
originator:
hostId: caipssm01waynpa
appName: interface
appInstanceId: 340
time: Sep 03, 2008 20:19:16 UTC offset=-240 timeZone=GMT-05:00
netInterfaceMissedPacketThresholdExceeded:
description: GigabitEthernet0/1 : Missed-packet threshold was exceeded. 3% of packets were missed.
interfaceName: GigabitEthernet0/1
I was wondering if anyone had ran into this issue...
I am running 6.1.1E2 and ASA OS 7.2.1...
I appreciate any help
Thank in a advance

After monitoring for few hours. I am getting the Missed packets events with MRTG showing 11M traffic on Gig0/1 interface.
evStatus: eventId=1218593040808080769 vendor=Cisco
originator:
hostId: caipssm01
appName: interface
appInstanceId: 340
time: Sep 05, 2008 22:05:46 UTC offset=-240 timeZone=GMT-05:00
netInterfaceMissedPacketThresholdExceeded:
description: GigabitEthernet0/1 : Missed-packet threshold was exceeded. 14% of packets were missed.
interfaceName: GigabitEthernet0/1
MRTG Graph data:
day
Max Average Current
In 1414.9 kB/s (3.2%) 816.5 kB/s (1.9%) 1227.9 kB/s (2.8%)
Out 1415.0 kB/s (3.2%) 816.5 kB/s (1.9%) 1227.9 kB/s (2.8%)
Looks like I am not even getting 88Mbs throughput with AIP-SSM20 module.
Any recommendation?
Thanks in a advance

Similar Messages

  • Do I need two AIP-SSM modules if I am configuring failover?

    Is it possible to use a single AIP-SSM module in two ASA's that are configured in Active/Standby mode?
    I would like to configure the module in the first ASA with the fail-open setting.  Then, if the first ASA fails, I could then physically remove the AIP-SSM module and place it in the second ASA.
    Would there be any problems configuring it this way?
    Would the active/standby ASA's complain that there is only one AIP-SSM module?
    Thanks in advance.

    Hello Julio. My name is Rogelio, and I would appreciate your answer on a related matter, because I will have to execute the initial configuration of a failover pair, each one with its own IPS module.
    Question: let´s suppose that I execute a basic setup (admin username/password, IP address, mask, gateway), on the IPS module of the active ASA firewall. ¿Will this configuration be replicated to the IPS module of the secondary unit?
    Your kind answer will be greatly appreciated.
    Best regards...

  • How to buy license? for AIP-SSM-10 ?

    Hi all
    how to buy license? for AIP-SSM-10 ?
    1. CON-SU1-AS1A1PK9 this is Cisco SMARTnet Support for AIP-SSM-10
    2. do I need smartnet for ASA ?
    3. what is part number of license ?
    ASA5510test# session 1
    Opening command session with slot 1.
    Connected to slot 1. Escape character sequence is 'CTRL-^X'.
    login: cisco
    Password:
    ***NOTICE***
    This product contains cryptographic features and is subject to United States
    and local country laws governing import, export, transfer and use. Delivery
    of Cisco cryptographic products does not imply third-party authority to import,
    export, distribute or use encryption. Importers, exporters, distributors and
    users are responsible for compliance with U.S. and local country laws. By using
    this product you agree to comply with applicable laws and regulations. If you
    are unable to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    ***LICENSE NOTICE***
    There is no license key installed on the SSM-IPS10.
    The system will continue to operate with the currently installed
    signature set.  A valid license must be obtained in order to apply
    signature updates.  Please go to http://www.cisco.com/go/license
    to obtain a new license or install a license.
    sensor#
    sensor# sh ver
    Application Partition:
    Cisco Intrusion Prevention System, Version 6.0(6)E3
    Host:
        Realm Keys          key1.0
    Signature Definition:
        Signature Update    S399.0                   2009-05-06
        Virus Update        V1.4                     2007-03-02
    OS Version:             2.4.30-IDS-smp-bigphys
    Platform:               ASA-SSM-10
    Serial Number:          ........
    No license present
    Sensor up-time is 21 min.
    Using 655507456 out of 1032499200 bytes of available memory (63% usage)
    application-data is using 39.7M out of 166.8M bytes of available disk space (25%
    usage)
    boot is using 37.6M out of 68.6M bytes of available disk space (58% usage)
    MainApp          N-NUBRA_2009_JUL_15_01_10_6_0_5_57   (Ipsbuild)   2009-07-15T01
    :15:08-0500   Running
    AnalysisEngine   N-NUBRA_2009_JUL_15_01_10_6_0_5_57   (Ipsbuild)   2009-07-15T01
    :15:08-0500   Running
    CLI              N-NUBRA_2009_JUL_15_01_10_6_0_5_57   (Ipsbuild)   2009-07-15T01
    :15:08-0500
    Upgrade History:
      IPS-K9-6.0-6-E3   17:48:06 UTC Wed Jul 15 2009
    Recovery Partition Version 1.1 - 6.0(6)E3
    sensor#

    Hi,
    CON-SU1-AS2A10K9 contract if for ASA+IPS bundle. If AIP-SSM-10 ws purchased as a spare the contract would be CON-SU1-ASIP10K9.
    I am not sure whether or not this Cisco Service for IPS contract can be  used to cover just the AIP-SSM-10 if it was purchased as part of a  Bundle instead of a Spare.
    I would recommend that you check with your Cisco reseller or Cisco  Sales Representative.
    Sourav

  • Using ASA5510 AIP-SSM in IDS mode

    Hi,
    I' ve a Cisco ASA5510 with  AIP-SSM and I wold like to use it like a one-armed IDS for connect them to a span port of a switch in my network,
    without the traffic passing through the Firewall.
    I've try to configure it and connect the interface inside (fast0/1) to the span port, I create the policy for permit  all the traffic to the  Sensor but it doesn't work, no packet recived on sensor.
    somebody can help me?
    thanks

    Unfortunately you can't use the AIP-SSM in an ASA with a spanning switch like you could with the 4200 series appliances.
    The reason is that the ASA was built to be a firewall, and no matter how much of that functionality you turn off, it still needs to see TCP and UDP conversations flowing thru the ASA in order to pass that traffic to the AIP-SSM sensor (I tired very hard to see if I could get around this limitation, but you can't).
    The best you can hope to do is put the ASA in-line (I know this reduces reliability) and turn off as much of the firewall configs you can. Then you can promisciously monitor the traffic passing thru teh ASA with teh AIP-SSM.
    It's not ideal, but it's the cheapest IPS sensor in Cisco's line up right now.
    - Bob

  • Will the AIP-SSM for the ASA stop this?

    I have a client emailed me today that someone did a script injection attack on one of their web servers. It ran a backdoor Trojan virus on their web server. I know the AIP-SSM will stop the Trojan, but will it stop someone from doing the script injection attack. If so, is it documented and can you point me to the document.
    Thanks.
    Dan

    Hi,
    If you know exactly which of the various script injection attacks was used you can simply look it up here:
    http://tools.cisco.com/security/center/home.x
    If you don't know exactly which one then it's slightly harded to know whether it would have been stopped, but searching on "script injection" or similar should narrow down the candidates and give you an idea on whether it would have been stopped or not.
    Remember that an IPS isn't perfect, but it *will* significantly lower your risk if setup and maintained properly.
    HTH
    Andrew.

  • Single AIP-SSM in Cisco ASA Failover Active / Standby Mode

    Hi,
    I can add single AIP-SSM on Cisco ASA in failover active / standby mode?

    No, both units need the same hardware, that includes the installed modules.
    Sent from Cisco Technical Support iPad App

  • Password Reset for AIP-SSM 10

    Hi,
    i have an ASA5520 with v 7.2(2) running.
    but the IPS module spftware is 5.1
    when i tried to login to the > session 1
    it prompts me for a login and password.
    i tried cisco and a few other combinations.. but no luck ,,
    how do i reset it ?? also that reset procedure on the docs says its resets password or the user cisco ..
    how can i be sure if the user cisco even exists on it or not ?
    any help please ???

    no man it doesnt ..
    the link u specified says it too..
    hw-module module slot_number password-reset?This command recovers a password on a Cisco ASA 5500 Series Content Security and Control Security Services Module (CSC-SSM) or the AIP-SSM without having to re-image the device.
    Note: This command starts support from IPS 6.0 (ASA 7.2 version) and is used to restore the Cisco CLI account password to the default cisco
    hers my ASA and IPS details..
    ASA# sh version
    Cisco Adaptive Security Appliance Software Version 7.2(2)
    Device Manager Version 5.2(2)
    Compiled on Wed 22-Nov-06 14:16 by builders
    System image file is "disk0:/asa722-k8.bin"
    Config file at boot was "startup-config"
    ASA up 22 days 3 hours
    Hardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
    ASA# sh module 1
    Mod Card Type Model Serial No.
    1 ASA5500 SSM-10 ASA-SSM-10 B155670DW4
    Mod MAC Add Range Hw Ver. Fw Ver. Sw Ver.
    1 00xx to 001 1.0 1.0(10)0 5.0(2)S152.0
    Mod SSM Apps. Name Status SSM Apps Version
    1 IPS Up 5.0(2)S152.0
    Mod Status Data Plane Status Compatibility
    1 Up Up

  • Sync configs between AIP-SSMs

    We have a pair of ASA 5520s in active/stanby mode. This part of the situation works great, configurations are always synced to the standby, nothing is lost. Planned failover has worked every time without users even noticing.
    We have an AIP-SSM-20 in each.
    The challenge arises as it seems there is still no easy and automatic way to sync the configuration of the SSMs together.
    Due to all the false positives, we need to perform configurations on the AIP-SSMs. Is there a method I am overlooking, how do you do it?
    Thanks.

    Thanks for your reply. I've gotten back on this subject....
    Does this run as a service, like it is running all the time and needs to be installed on a system which is always up, or does this run as an application only as needed.
    Based on the requirements, I can not tell. It can run on desktop OSes or Server OSes.
    "Hard Drive
    • 100 GB
    Memory (RAM)
    • 2 GB
    Supported Operating Systems
    • Windows Vista Business and Ultimate (32-bit only)
    • Windows XP Professional (32-bit only)
    • Windows 2003 server
    Note: Cisco IPS Manager Express supports only the 32-bit U.S. English version of Windows."
    100GB for an application, seems rather hefty to me. Is this for real?
    Thanks

  • How to block p2p applications(Bittorent like) with AIP-SSM-10?

    Hi,
    How to block p2p application using AIP-SSM-10 working with ASA5520?AIP is on promiscuous mode.
    Thanks,
    Siva

    There are several signatures that detect p2p, for bit torrent there is 11020.0
    Yahoo triggers: 5539.0, 11200.0, 11212.0, 11217.0 & 11219.0
    etc..
    Some are disabled by default though so please ensure you enable the ones that you need.
    If you want to block these then you will have to use event actions that work in promiscuous setup for example request block connection and tcp reset. Please note that care must be taken when using these event actions.
    For more information about the event actions please refer the link below:
    http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/idmguide/dmevtrul.htm#wp1069467

  • How to identifiy AIP-SSM-10 ot CSC-SSM-10 do I have ?

    how to identifiy AIP-SSM-10 ot CSC-SSM-10 do I have on my asa5520 ?

    you can find the information in this link
    http://www.cisco.com/en/US/products/ps6120/products_installation_guide_chapter09186a00805ad777.html

  • Obtaining hardware and signature support for AIP SSM-10

    We have a 5510 which we have purchased an AIP SSM-10 card for the ASA which is already under a support contract. We now wish to add hardware maintenance for the new AIP SSM-10 card as well as signature updates. Our Cisco supplier will not confirm that we will receive signature updates with the hardware support though (we have been trying to get an answer from them since June or July now).
    Could someone let us know what the correct part number is so we can ask for the specific option that will provide both hardware cover and signature updates.

    i think this is what you need,
    CON-SU1-AS1A1PK9
    IPS SVC, AR NBD ASA5510-AIP10SP-K9
    cisco smartnet support

  • Signature Updates for AIP-SSM 10

    Hi all how can i obtain Signature Updates for AIP-SSM 10 where i am having 60 day trial license with me

    Here is the main file download page for the IPS sensors.
    Find the section for the version you are running and click on the Latest Signature Updates link to take to you to the download page for signature updates.
    You can then download which ever signature update you want.
    NOTE1: Each Signature Updates contains all signatures from previous Sig levels. So you only need to download the latest one.
    NOTE2: Each signature update has a specific E (Engine) level requirement. You can execute "show ver" on your sensor to determine if it is at an E1 or E2 level. If it is at E1 and you want the latest sigs that require E2 then you will first need to install the E2 upgrade.
    On that main download page look for the "Latest Upgrades" link for your version, and look for the IPS-engine-E2-req-X.X-X.pkg file where the X.X-X matches your sensor version.
    If there is not an X.X-X matching your sensor version, then you may need to upgrade the software version for your sensor as well.
    NOTE3: Many of these links will also require an account on cisco.com. And for some of these files that account may also need to be verified for being from a country where the USA's export restrictions allow downloads for encryption. (Most countries qualify but you do have to go through that qualification step). It has been over 10 years that I have had do this so I am not sure of the latest procedures for getting an account or validating it for encrpytion downloads.

  • How to generate license for AIP-SSM without PAK-number?

    Hello! I’m sorry for my English. I have a problem with generating license for AIP-SSM. My contract with SMARTnet service is activated, but I don’t have a PAK-number. How I can generate a license for updating my module?

    Alternatively you can always write an email to [email protected] with your serial number and they should be able to provide you the license for any cisco device.
    Sachin

  • AIP-SSM Upgrade Procedure

    Hi everybody!
    I have ASA5520 version 8.2(1) with AIP-SSM-20 module
    and I want to upgrade AIP-SSM-20 software from version 6.1(3)E3 to 7.0(2)E4
    I go to the download site and see the following list:
    Intrusion Prevention System (IPS) Recovery Software:
    IPS-K9-r-1.1-a-7.0-2-E4.pkg
            Release Date: 29/Mar/2010
            IPS Recovery Image File
    Intrusion Prevention System (IPS) Signature Updates:
    IPS-sig-S481-req-E4.pkg
            Release Date: 31/Mar/2010
            E4 Signature Update S481
    Intrusion Prevention System (IPS) System Software:
    IPS-SSM_20-K9-sys-1.1-a-7.0-2-E4.img
            Release Date: 29/Mar/2010
            IPS-SSM_20 System Image File
    Intrusion Prevention System (IPS) System Upgrades
    IPS-K9-7.0-2-E4.pkg
            Release Date: 29/Mar/2010
            IPS 7.0 Major Upgrade File (All Supported Platforms Except AIM-IPS and NME-IPS)
    IPS-engine-E4-req-7.0-2.pkg
            Release Date: 29/Mar/2010
            IPS E4 Engine Update
    I am somewhat confused by the number of files and want to ask what the procedure/sequence I should follow to upgrade?

    This is the file that you would like to use to upgrade it:
    Intrusion Prevention System  (IPS) System Upgrades
    IPS-K9-7.0-2-E4.pkg
    To upgrade:
    1) Upload the "IPS-K9-7.0-2-E4.pkg" file through IDM
    2) IDM --> Configuration --> Sensor Management --> Update Sensor --> choose Update is located on this client --> choose the "IPS-K9-7.0-2-E4.pkg" file --> hit the "Update Sensor" button.
    It will take a while (around 20 minutes) to upgrade the sensor, so don't panic if it doesn't come back up in "UP" status straight away.
    Hope that helps.

  • AIP-SSM, it is not sensing the traffic

    Hi everyone, i have a trouble, now iam using an ASA 5510 with AIP-SSM10, my problem is when I redirect the traffic to the AIP-SSM for detects attacks, i probe it and then I look in the events logs of the IPS, and the sensor dont detect nothing, is necessary to install an IPS license??, it is for my own project, thanks.

    Unless you are scanning across the ASA, the SSM module will not "see" the scan and cannot produce events. To alarm on an SSM module, you must scan from one network to another. Basically, the SSM cannot do promiscuous monitoring. I would recommend an IPS appliance if you want to monitor traffic sent between hosts of the same network.
    ** Pls rate if this helps **

Maybe you are looking for