AIP-SSM interface

What does the interface configuration in AIP-SSM indicates ?
If this indicates that the traffics of this interface will be monitored, then what is the purpose of diverting traffic from asa though policy command.

I would suggest an upgrade to the latest version which is 7.0.2(E3). You can upgrade directly to that version if you are currently already running at least 5.1.6(E3).
To upgrade:
1) Download the upgrade package:
http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=7.0%282%29E3&mdfid=280432811&sftType=Intrusion+Prevention+System+%28IPS%29+System+Upgrades&optPlat=&nodecount=2&edesignator=null&modelName=Cisco+ASA+Advanced+Inspection+and+Prevention+%28AIP%29+Security+Services+Module&treeMdfId=268438162&treeName=Security&modifmdfid=null&imname=&hybrid=Y&imst=N&lr=Y
2) Go to IDM: Configuration --> Sensor Management --> Update Sensor --> upload the upgrade package from your local computer and update it.
Hope it helps.

Similar Messages

  • AIP SSM Command/control Interface is not coming up

    Hi to all,
    kindly be informed that , i have AIP SSM for ASA, i configured it and its workign fine.but its command control interface is not coming up at all, i connect my lap top direct to AIP management interface but its status is always is down.kindly look at this configuration and guide me how i can communicate with AIP using mangement inerface.
    My LapTop ip is 192.168.1.2/24
    AIP Configuration
    IPS1# sh ver
    Application Partition:
    Cisco Intrusion Prevention System, Version 6.2(1)E3
    Host:
    Realm Keys key1.0
    Signature Definition:
    Signature Update S365.0 2008-10-31
    Virus Update V1.4 2007-03-02
    OS Version: 2.4.30-IDS-smp-bigphys
    Platform: ASA-SSM-20
    Serial Number: JAF1319AJRG
    No license present
    Sensor up-time is 13 days.
    Using 1019777024 out of 2093604864 bytes of available memory (48% usage)
    application-data is using 47.1M out of 166.8M bytes of available disk space (30% usage)
    boot is using 39.7M out of 68.6M bytes of available disk space (61% usage)
    MainApp E-2008_OCT_16_16_24 (Release) 2008-10-16T16:40:57-0500 Running
    AnalysisEngine E-2008_OCT_16_16_24 (Release) 2008-10-16T16:40:57-0500 Running
    CLI E-2008_OCT_16_16_24 (Release) 2008-10-16T16:40:57-0500
    Upgrade History:
    IPS-K9-6.2-1-E3 16:24:00 UTC Thu Oct 16 2008
    Recovery Partition Version 1.1 - 6.2(1)E3
    Host Certificate Valid from: 12-Jul-2009 to 13-Jul-2011
    IPS1#sh conf
    ! Current configuration last modified Sun Jul 12 23:56:08 2009
    ! Version 6.2(1)
    ! Host:
    ! Realm Keys key1.0
    ! Signature Definition:
    ! Signature Update S365.0 2008-10-31
    ! Virus Update V1.4 2007-03-02
    service interface
    exit
    service authentication
    exit
    service event-action-rules rules0
    exit
    service host
    network-settings
    host-ip 192.168.1.3/24,192.168.1.1
    host-name Cinet-IPS1
    telnet-option enabled
    access-list 0.0.0.0/0
    exit
    time-zone-settings
    offset 0
    standard-time-zone-name UTC
    exit
    exit
    service logger
    exit
    service network-access
    exit
    service notification
    exit
    service signature-definition sig0
    exit
    service ssh-known-hosts
    exit
    service trusted-certificates
    exit
    service web-server
    exit
    service anomaly-detection ad0
    exit
    service external-product-interface
    exit
    service health-monitor
    exit
    service analysis-engine
    virtual-sensor vs0
    physical-interface GigabitEthernet0/1
    exit
    exit

    If the interface won't link Up, then it is likely a cabling problem.
    Even with a bad configuration on the AIP you should at least get link UP if your cabling is correct, so I don't think configuration is your problem here.
    If I remember right the command and control interface of the SSM is a 10/100 TX interface. When connecting from a laptop directly to the command and control interface it would require a cross over cable rather than the normal straight through cable.
    If you don't have a cross over cable, then try connecting the SSM to a switch and see if the SSM will link UP. The switch is designed to internally do the cross over.

  • Using ASA5510 AIP-SSM in IDS mode

    Hi,
    I' ve a Cisco ASA5510 with  AIP-SSM and I wold like to use it like a one-armed IDS for connect them to a span port of a switch in my network,
    without the traffic passing through the Firewall.
    I've try to configure it and connect the interface inside (fast0/1) to the span port, I create the policy for permit  all the traffic to the  Sensor but it doesn't work, no packet recived on sensor.
    somebody can help me?
    thanks

    Unfortunately you can't use the AIP-SSM in an ASA with a spanning switch like you could with the 4200 series appliances.
    The reason is that the ASA was built to be a firewall, and no matter how much of that functionality you turn off, it still needs to see TCP and UDP conversations flowing thru the ASA in order to pass that traffic to the AIP-SSM sensor (I tired very hard to see if I could get around this limitation, but you can't).
    The best you can hope to do is put the ASA in-line (I know this reduces reliability) and turn off as much of the firewall configs you can. Then you can promisciously monitor the traffic passing thru teh ASA with teh AIP-SSM.
    It's not ideal, but it's the cheapest IPS sensor in Cisco's line up right now.
    - Bob

  • ASA failover with 1 AIP SSM in Active/Standby?

    I have a customer with two ASAs; in Active/Standby. They want to purchase one AIP. Will failover (without the AIP functionality) to the Standby work if the AIP is configured for Promiscuous mode? Thanks, Bob

    The only connection to the SSM that can be done internally through the ASA is a "session". This is an internal telnet to the SSM and can be used to access the SSM's CLI.
    This is very usefull when you manage your SSM directly through the CLI.
    However, most customers prefer to use a graphics based tool like IDM, ASDM, or CSM for managing the configuration of the SSM, and prefer to use a graphics based tool like IEV or CS MARS for monitoring of the alerts from the SSM.
    All of these graphics based tools need network access to the SSM through a web port (https on port 443 by default). Access to this port is not allowed internally through the ASA direct to the SSM.
    All web connections must be made to the External Management interface of the SSM.
    If you are not using all 4 of your ASA interfaces you could choose to wire the External SSM interface directly to one of your ASA interfaces, and create a small subnet for the ASA and IPS IP Addresses. So then all external connections to the SSM would be routed into the ASA, then out of the ASA, and into the external port of the SSM.
    That subnet of just the ASA and SSM could be made using a network reserved for local IPs (like a 10, or 172, or 192 network) and then use NAT/PAT for translation on the other network interfaces of the ASA.
    But it does still require that wire connected to the external port of the SSM.

  • Configuring SNMP Trap receiver on AIP-SSM sensor

    I receive the following error message from my ASA5520 firewall when attempting to forward SNMP traps from my AIP-SSM20 sensor to a server on my Inside interface that is configured to receive SNMP traps:
    ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src management: 10.3.21.2/32768 dst Inside: PPC0ES/162
    Can I reconfigure the management IP address of the AIP-SSM sensor to connect to the Inside interface instead of the management vlan or does my SNMP server have to reside on the management vlan with the sensor?

    Hi Subodh,
    Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
    If you have any other specific questions, feel free to post back.
    Hope that helps.
    -Mike

  • AIP-SSM configuration assistance

    I have two questions regarding the AIP-SSM.
    1) Does the ACL on AIP-SSM have any type of relations to the ASA ACL?
    2) Our four interfaces are all in use. Is it possible to assign the SSM an IP address in the same subnet as the management interface?
    3) Should then the management interface be used as the gateway for the SSM?
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 65.x.x.1 255.255.255.0 standby 65.x.x.2
    interface GigabitEthernet0/1
    nameif dmz
    security-level 50
    ip address 172.16.x.1 255.255.255.0 standby 172.16.x.2
    interface GigabitEthernet0/2
    nameif inside
    security-level 100
    ip address 192.168.x.1 255.255.255.0 standby 192.168.x.2
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    speed 100
    duplex full
    nameif management
    security-level 100
    ip address 10.0.x.1 255.255.255.0 standby 10.0.x.2
    management-only

    Here are the answers to your questions-
    1) Does the ACL on AIP-SSM have any type of relations to the ASA ACL?
    Ans) No. ACL on SSM is completely independent of ACLs on ASA.
    2) Our four interfaces are all in use. Is it possible to assign the SSM an IP address in the same subnet as the management interface?
    Ans) Absolutely. You can assign the management port of SSM an IP in the same subnet as your managemnet interface. That way all management traffic will be kept independent of normal DATA traffic.
    3) Should then the management interface be used as the gateway for the SSM?
    Ans) You are right .. :-)
    Hope that helps.
    Regards,
    Vibhor.

  • Configuring AIP-SSM modelue

    hi,
    we have AIP-SSM-40 modeule installed on ASA 5540 but it is just physically present.
    Is it possible to configure to this modeule in inline or like IDS mode? It has only one Ethernet interface. Can this interface be treated as sensor interface and mark a copy of all incoming frames on this interface ( by SPA on switches ).
    Please share the experience.
    Thanks in advance.
    Subodh

    Hi Subodh,
    Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
    If you have any other specific questions, feel free to post back.
    Hope that helps.
    -Mike

  • How ASA forwarding traffic to AIP-SSM

    Hi All,
    Can someone help how ASA device forwarding traffic to AIP-SSM? I'm not taking abt Configuration part like Class-map, policy-map and service policy....want to understand the traffic flow from ASA once traffic matched with ACL to AIP-SSM.
    From one of Cisoc document, understood that the module using a Cisco Propietary protocol for communicating with ASA appliance.
    ================================================================================================================
    FYR from Cisco Website:
    Q. How does the Cisco ASA AIP-SSM plug into and communicate with the appliance?
    A. The Cisco ASA AIP-SSM plugs directly into the SSM slot in the Cisco ASA appliance's chassis. This provides a direct connection to the appliance's backplane. Once the module is installed, a proprietary protocol runs over the bus and controls data flow and messaging between the module and appliance.
    ================================================================================================================
    Regards,
    S.Vinoth

    Hey ,
    as you mentioned above , it uses a cisco Probietary protocol for that communication , there are two interfaces , control channel and data channnel , data channel is where the traffic being forwarded , the backplane is the connection between the ASA and the IPS interface .
    Hope that this helps .
    Mohammad.

  • AIP-SSM module hung

    I have recently confgured my AIP-SSM-20 module in my firewalls (ASA 5540) which are configured in HA(Active/Standby).This implementation i have done on 13th June. It was working fine.
    Now, i have observerd that the AIP-SSM-20 module in the primary firewall had gone to unresponsive state.
    Below is the status of show module and show failover command.
    FW1-5540# sh module
    Mod Card Type                                    Model              Serial No.
      0 ASA 5540 Adaptive Security Appliance         ASA5540            JMX1234L11F
      1 ASA 5500 Series Security Services Module-20  ASA-SSM-20         JAF1341ADPS
    Mod MAC Address Range                 Hw Version   Fw Version   Sw Version
      0 0021.d871.77ab to 0021.d871.77af  2.0          1.0(11)4     8.0(3)6
      1 0023.ebf6.11ce to 0023.ebf6.11ce  1.0          1.0(11)5     6.2(2)E4
    Mod SSM Application Name           Status           SSM Application Version
      1 IPS                            Not Applicable   6.2(2)E4
    Mod Status             Data Plane Status     Compatibility
      0 Up Sys             Not Applicable
      1 Unresponsive       Not Applicable
    FW1-5540# sh failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: FAILOVER GigabitEthernet0/2 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 250 maximum
    Version: Ours 8.0(3)6, Mate 8.0(3)6
    Last Failover at: 09:06:14 UTC Jun 15 2010
            This host:
                    This host: Primary - Failed
                    Active time: 191436 (sec)
                    slot 0: ASA5540 hw/sw rev (2.0/8.0(3)6) status (Up Sys)
                      Interface DMZ_LAN (10.192.153.13): Normal (Waiting)
                      Interface INTRANET (10.192.154.13): Normal (Waiting)
                      Interface management (0.0.0.0): Link Down (Waiting)
                    slot 1: ASA-SSM-20 hw/sw rev (1.0/6.2(2)E4) status (Unresponsive/Down)
                      IPS, 6.2(2)E4, Not Applicable
            Other host: Secondary - Active
                    Active time: 192692 (sec)
                    slot 0: ASA5540 hw/sw rev (2.0/8.0(3)6) status (Up Sys)
                      Interface DMZ_LAN (10.192.153.5): Unknown (Waiting)
                      Interface INTRANET (10.192.154.5): Unknown (Waiting)
                      Interface management (0.0.0.0): Unknown (Waiting)
                    slot 1: ASA-SSM-20 hw/sw rev (1.0/7.0(2)E4) status (Up/Up)
                      IPS, 7.0(2)E4, Up
    Stateful Failover Logical Update Statistics
            Link : Unconfigured.
    I have tried using the
    hw-module module 1 reset
    to reset the IPS module but the status is always unresponsive.
    Its production environment where i cannnot expirement much. Ned help to rectify the problem.

    Hi Scott, 
    I have almost same problem of sbgcsd in my customer. I'm deploying two ASA-5512 in failover configuration. One day, after almost 2 months testing project in a lab, when we install in customer's datacenter the systems presented following errors:
      ciscoasa2(config)# failover
            Detected an Active mate
      ciscoasa2# Mate NOT PRESENT card in slot 1 is different from mine IPS5512
    I tried to discover what was happened with IPS modulo, then I saw error in IPS status: "Unresponsive".
      ciscoasa2# sh module ips
      Mod  Card Type                                    Model              Serial No.
       ips Unknown                                      N/A                FCH1712J7UL
      Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version
       ips 7cad.746f.8796 to 7cad.746f.8796  N/A          N/A 
      Mod  SSM Application Name           Status           SSM Application Version
       ips Unknown                        No Image Present Not Applicable  
      Mod  Status             Data Plane Status     Compatibility
       ips Unresponsive       Not Applicable 
      Mod  License Name   License Status  Time Remaining
       ips IPS Module     Disabled        perpetual
    According with Cisco Foruns I tried to "Reloading, Shutting Down, Resetting, and Recovering AIP-SSM" (*) using "hw-module module " command. But unfortunatelly ASA didn't accept this command. See below:
      ciscoasa2# hw-module module 1 reload
                 ^
      ERROR: % Invalid input detected at '^' marker
    What happened with this command (hw-module) ? Maybe is a problem in Software version ? When I entered "sh flash" command I saw that didn't exist any software for AIP-SMM module:
      ciscoasa2# sh flash
      --#--  --length--  -----date/time------  path
       11  4096        Sep 12 2013 13:56:54  log
       21  4096        Sep 12 2013 13:57:10  crypto_archive
      100  0           Sep 12 2013 13:57:10  nat_ident_migrate
       22  4096        Sep 12 2013 13:57:10  coredumpinfo
       23  59          Sep 12 2013 13:57:10  coredumpinfo/coredump.cfg
      101  34523136    Sep 12 2013 14:00:14  asa861-2-smp-k8.bin
      102  17851400    Sep 12 2013 14:04:36  asdm-66114.bin
      103  38191104    Apr 24 2014 12:59:58  asa912-smp-k8.bin
      104  6867        Apr 24 2014 13:01:20  startup-config-jcl.txt
      105  24095116    Jun 17 2014 14:54:14  asdm-721.bi
    But another ASA (#1) have image:
    ciscoasa1# sh flash
    --#--  --length--  -----date/time------  path
       11  4096        Sep 10 2013 06:42:56  log
       21  4096        Apr 17 2014 03:13:12  crypto_archive
      123  5276864     Apr 17 2014 03:13:12  crypto_archive/crypto_eng0_arch_1.bin
      110  0           Sep 10 2013 06:43:12  nat_ident_migrate
       22  4096        Sep 10 2013 06:43:12  coredumpinfo
       23  59          Sep 10 2013 06:43:12  coredumpinfo/coredump.cfg
      111  34523136    Sep 10 2013 06:44:24  asa861-2-smp-k8.bin
      112  42637312    Sep 10 2013 06:45:46  IPS-SSP_5512-K9-sys-1.1-a-7.1-4-E4.aip <===
    But I am not sure if this image is really the right image do AIP-SSM in ASA#2. But anyway I copy (through a simple TFTP server) from ASA#1 to ASA#2 , but after this, the same problem ramained ! 
    Because I didn't applied the Failover condition to system. 
    What can I do now ?
    Thank you very much in advance.
    Leonardo_Melo.(CCAI-JCL-Brazil).

  • Failure to Upgrade the software of my AIP-SSM-20

    Dear all,
    I have failed to upgrade the software of my AIP-SSM-20 on the ASA. The AIP-SSM-20 had an Image of version IPS-K9-5.1-7-E1.pkg and I tried to upgrade it to IPS-K9-6.1-1-E2.pkg but after the upgrade the AIP-SSM-20 became unusable. I can no longer log on  to the IPS Module from the ASA. When I initiated a connection to the module with session 1 command, the systems says card in slot 1 did not respond to system request. I decided to restored the system image from the ASA by using the hw-module module 1 recover configure and hw-module module 1 recover boot commands but has so far failed.When  I issued the command hw-module module 1 boot command, the status of the IPS shows recover and would be in that state even for days.And my TFTP server shows that it is transfering the images to the IPS.
    I don't know where I have gone wrong and I would be very happy if somebody can give me a procedure that would help me to re-image the software of the IPS.
    Any help would be highly appreciated.
    Claude Fozao

    Halijen has already send you a link to reimage,let me briefly answer what a system image and upgrade files are and the difference between them
    The System Image files are meant to be used only when a complete erasing of the sensor's image is needed.  This is generally because the installed files were corrupted, or so old that it would be easier to start over and make it look like it came from the factory; than to use the standard "upgrade" files.So in case you are doing reimaging than use .img files which are system reimage files
    In more than 90% of the cases, most customers will want to "upgrade" rather than do a System Image.  The "upgrade" is done from within the sensor itself, and will both load the higher version as well as convert your current configuration to work with the newer version.it uses .pkg files
    A usual poblem with the System Re-imaging process is that the card winds up in a boot loop because of an error.  When ROMMON detects an error it reboots and tries the same steps again which usually winds up with the same error which causes a reboot, etc.....
    So determining if the card is in a reboot loop, and what the error is would be the next step in your debugging process.
    Execute "debug module-boot".  Enter "hw-module module 1 recover stop".   Wait for a few minutes, and then enter "hw-module module 1 recover boot".
    The output from ROMMON on the SSM will be seen on your ASA connection.Look at the configuration being passed to the SSM's ROMMON and look for any bad entries.Watch to see if it able to download the System Image file, or if it continuously reboots.
    If it continuously reboots, then look to see what error message is seen just prior to the reboot.
    Some common problems:
    1) Typos in IP address, gateway, tftp server IP, or system image filename.
    2) If the tftp server is on the same subnet as the SSM's IP Address, then try leaving the Gateway address blank since it is not needed.
    3) Remember that the IP Address is for the external interface of the SSM.  So be sure you are using an address that is applicable for the network where you are pluggin in the SSM's external interface.
    4) If the TFTP Server is on another subnet, then be sure there is a route to the other network.  If having to route back through the ASA, then ensure that the ASA will allow TFTP packets to pass through the ASA.  (The ASA could wind up blocking the TFTP packets depending on the ASA configuration)
    5) Be sure the file can be downloaded from the TFTP server.  Check the file permissions, and the directory where the file is located.   From your desktop try to downlaod the file from the tftp server.  This will ensure you are using the correct directory and that the file has correct permissions.  Once common problem is that the file may be /tftpboot/sensorfiles/IPS-SSM_20-K9-sys-1.1-a-6.1-1-E1.img.  But because the tftp server automatically starts in /tftpboot, you may need to NOT specify it for the file and instead just use: sensorfiles/IPS-SSM_20-K9-sys-1.1-a-6.1-1-E1.img
    6) Check to make sure the file is not corrupted by running an md5sum and checking it against the value listed on cisco's web site.

  • AIP-SSM 20 questions

    Hi,
    we have this module on an ASA 5540, while the inspection load is reaching a max of 35% , the cpu is reaching 100% sometimes.
    1- how do i check the current bandwidth in Mbs being inspected ?
    2- how do i check if there is drops when cpu is reaching 100%
    3-if cpu hangs at 100% will fail-open work or will the module start dropping legitimate packets
    4- should i upgrade my card to AIP-SSM 40 allthough inspection load is still 35% ?
    Thank you

    To check if your sensor is dropping packets, get on the CLI and run
    show interface - This will show you an averaged packet loss across all interfaces since last reset and on a per-interface basis.
    show event stat past 01:00 inc missed - This will show you any peaks in your missed pckets over the last hour.

  • AIP-SSM Int gig0/0

    Looking for an explanation of the gig0/0 interface in the AIP-SSM-20. The ASA runs 8.2 and the IPS runs 6.2.
    The documentation I'm reading doesn't mention it all. I want a management interface separate from the default connection between the ASA and the ips module.

    Hi Tanveer,
    Thanks for the detailed response.
    I believe that I was confusing the different modules.
    Here is one last question from the setup command and the advanced configuration:
    Management0/0 and gigabit 0/1 are given different IP addresses, correct? We want to use a same management vlan used by all networking devices. Does the gig0/1 have a different ip and is it the interface which connects to the ASA over the backplane?
    Modify interface/virtual sensor configuration?[no]: yes
    Current interface configuration
    Command control: Management0/0
    Unassigned:
    Monitored:
    GigabitEthernet0/1
    Thank you in advance!

  • AIP-SSM How to Verify Traffic is being passed for inspection?

    "show conf" command on my AIP SSM CLI. gigabitEthernet0/1 backplane interface of the SSM has not been assigned to virtual sensor vs0.but
    Through this command show service-policy
    traffic is recevied by IPS Module.why this,
    Kindly guide me

    Thanks,i got it.
    Cinet-IPS1# show statistics virtual-sensor
    Virtual Sensor Statistics
    Statistics for Virtual Sensor vs0
    Name of current Signature-Defintion instance = sig0
    Name of current Event-Action-Rules instance = rules0
    List of interfaces monitored by this virtual sensor = GigabitEthernet0/1 subinterface 0
    General Statistics for this Virtual Sensor
    Number of seconds since a reset of the statistics = 434653
    SensorApp Memory Use Percentage = 33
    Processing Load Percentage = 1
    Total packets processed since reset = 1722
    Total IP packets processed since reset = 1722
    Total IPv4 packets processed since reset = 1722
    Total IPv6 packets processed since reset = 0
    Total IPv6 AH packets processed since reset = 0
    Total IPv6 ESP packets processed since reset = 0
    Total IPv6 Fragment packets processed since reset = 0
    Total IPv6 Routing Header packets processed since reset = 0
    Total IPv6 ICMP packets processed since reset = 0
    Total packets that were not IP processed since reset = 0
    Total TCP packets processed since reset = 1466
    Total UDP packets processed since reset = 0
    Total ICMP packets processed since reset = 256
    Total packets that were not TCP, UDP, or ICMP processed since reset = 0
    Total ARP packets processed since reset = 0

  • Transparent mode with AIP-SSM-20

    I currently have an ASA5510 in routed mode with an AIP-SSM-20.
    There is a requirement to use a fibre optic connection between this ASA and another ASA across campus, so the AIP-SSM will have to be removed and replaced with the SSM-4GE.  This part should present no issue.
    However, this will remove the IPS device, and I still want to use IPS.
    So, what I am thinking is to get another ASA5510, install the AIP-SSM, configure ASA for transparent mode and put it in between the inside of the routed ASA and my LAN.  The transparent ASA would be functioning strictly as an IPS appliance.
    Setup would look something like this:
    Internal LAN <> transparent ASA with IPS <> routed ASA <> WAN
    Can the AIP-SSM still perform IPS with the ASA in transparent mode?
    Is there a way to configure the ASA and AIP-SSM such that traffic to/from a particular server completely bypasses the AIP-SSM?
    I have a couple of fileservers that generate heavy traffic and could overload the AIP-SSM.
    Regards.

    AFAIR, There is no problem to setup AIP in a transparent firewall.
    "An ASA in transparent mode can run an AIP.  In the event the AIP fails,
    the IPS will fail-open and the ASA will continue to pass traffic.
    However, if an interface or cable fails, then traffic will stop.  You
    would need a failover pair to account for this failure event, which
    means another ASA and matching AIP."
    And no there is no problem to exclude certain hosts/ports/subnets from inspection by IPS via MPF.
    http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ips.html#wp1050744
    What I however consider however is if the ASAs 5510 as second tier firewall for 5520s will be enough.
    http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html
    HTH,
    Marcin

  • Do I need two AIP-SSM modules if I am configuring failover?

    Is it possible to use a single AIP-SSM module in two ASA's that are configured in Active/Standby mode?
    I would like to configure the module in the first ASA with the fail-open setting.  Then, if the first ASA fails, I could then physically remove the AIP-SSM module and place it in the second ASA.
    Would there be any problems configuring it this way?
    Would the active/standby ASA's complain that there is only one AIP-SSM module?
    Thanks in advance.

    Hello Julio. My name is Rogelio, and I would appreciate your answer on a related matter, because I will have to execute the initial configuration of a failover pair, each one with its own IPS module.
    Question: let´s suppose that I execute a basic setup (admin username/password, IP address, mask, gateway), on the IPS module of the active ASA firewall. ¿Will this configuration be replicated to the IPS module of the secondary unit?
    Your kind answer will be greatly appreciated.
    Best regards...

Maybe you are looking for