CPU OID MIB for ASA-SSM-10

Hi,
I want to use our SNMP server to monitor our IPS modules CPU and Memory, does anyone knw the OID(s) I need to use?
Thanks

That's frustrating, the IPS specific MIBS are not in the Cisco MIB locators:
For non-IOS
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
For IOS
http://tools.cisco.com/ITDIT/MIBS/MainServlet')">http://tools.cisco.com/ITDIT/MIBS/MainServlet
But if memory serves, the IPS sensors support the standard enterprise MIB, so the OID should be common.

Similar Messages

IME connection requirements for ASA-SSM module

I am looking into monitoring an IPS device at a remote site over the internet. I would like to install IME at my main site and have IME connect to the SSM module at the remote site over the internet. Can anyone offer advice on the TCP ports required (is it simply tcp 443) and if this is advisable? Any ideas on how much traffic this would generate over the internet connection?
My thoughts are that I could create a static translation on the ASA for the IP address of the management interface of the SSM module and restrict access through the ASA to my main site public IP address.
Any assistance is much appreciated.

Hi,
All you need is to open up TCP/443 for the IME to be able to successfully connect. So, you can have a static for the SSMs management IP address on TCP port 443 and put in an access-list entry to allow that traffic.
I am not really sure of how much traffic this will take up but it should not be much.
Hope this helps. let me know how it goes!!
Thanks and Regards,
Prapanch

Signature recommendations for ASA-SSM-10

hi, I was wondering if anyone has recommendations on what sigs to enable on the ASA-SSM-10.......I know.... to a certain extent, 'it depends' on your individual environment. But I think it must be the case that there are some disabled sigs that are good to enable..right? I was hoping to tap into the 'group mind' on what works well.
Also, why not enable all? I am assuming the ASA-SSM-10 probably cannot keep up with that level of inspection??
thanks in advance

androdri,
Thanks for your reply. I have some followup questions.
1. I noticed that any signature that is disabled is listed as retired....does retired mean disabled or something else (like not needed any more).
2. it seems like most of the malware sigs are disabled, i would think that if you are in a user environment, you would want those on, is there an example of a situation that you would not want them on....how do you know if you have a problem if you don't look.
thanks

Download signatures for ASA-SSM-10

I have a couple of ASA with some SSM-10 and SSM-20 modules. My CSM is currently not working on the auto update side and i'm a bit behind on the updates till I figure out what's the issue.. Can somebody tell me what link can I manually downoad the signatures the how to update it from either IDM or IME pertaining to a SSM-10/20 ?
My last update history shows.
Upgrade History:
* IPS-sig-S535-req-E4 04:55:41 UTC Sat Dec 11 2010
IPS-sig-S537-req-E4.pkg 04:55:33 UTC Wed Jan 05 2011
so these are the signature trains I'm after..
thanks

The download URL was posted in the above reply (and can also be found in the IDS/IPS - Quick Links document). As far as installing the update via IME: You can do that by navigating to IME's Configuration > Sensor Management > Update Sensor section. From there, check (select) the radio button next to Update is located on this client, then click the Browse Local... button to select the file, and finally click the Update Sensor button to transfer and install the update.

LMS 4.0 ASA-SSM-10 Sync archive

Hello.
During Sync archive for ASA-SSM-10 which is installed in ASA 5505 device I received the error:
*** Device Details for Cisco ASA IPS ***
Protocol ==> Unknown / Not Applicable
Selected Protocols with order ==> Telnet,SSH
Execution Result:
RUNNING
CM0151 PRIMARY RUNNING Config fetch failed for Cisco ASA IPS Cause: TELNET: Failed to establish TELNET connection to 172.26.22.32 - Cause: Authentication failed on device 3 times.
SSH: Failed to establish SSH connection to 172.26.22.32 - Cause: Authentication failed on device 3 times.
Action: Check if protocol is supported by device and required device package is installed. Check device credentials. Increase timeout value, if required.
The connection to this device (ASA-SSM-10) is possible with SSH protocol with Putty and with SecureCRT. What has to be change in the LMS to sucess with Sync archive and later with changing the archive with the LMS 4.0. Thank you.

Post the show ver of the device and we can verify if its supported or not and the OID as well.

ASA SSM IPS module upgrade won't work

Hello all,
I'm trying to upgrade the IPS sig's on an ASA5520 with a SSM IPS module. I'm trying to upgrade the system to 5.1.1 to further upgrade the device with no luck.
I followed these steps provided by Cisco.com:
1. Log in to the ASA.
2. Enter enable mode:
asa# enable
3. Configure the recovery settings for ASA-SSM:
asa (enable)# hw-module module 1 recover configure
NOTE: If you make an error in the recovery configuration, use the
hw-module module 1 recover stop command to stop the system reimaging
and then you can correct the configuration.
4. Specify the TFTP URL for the system image:
Image URL [tftp://0.0.0.0/]:
Example:
Image URL [tftp://0.0.0.0/]: tftp://10.20.30.40/IPS-SSM-K9-sys-1.1-a-5.1-1.img
5. Specify the command and control interface of ASA-SSM:
Port IP Address [0.0.0.0]:
Example:
Port IP Address [0.0.0.0]: 11.21.31.41
6. Leave the VLAN ID at 0.
VLAN ID [0]:
7. Specify the default gateway of the ASA-SSM:
Gateway IP Address [0.0.0.0]:
Example:
Gateway IP Address [0.0.0.0]: 11.22.33.44
8. Execute the recovery:
asa# hw-module module 1 recover boot
9. Periodically check the recovery until it is complete.
NOTE: The status reads "Recovery" during recovery and reads "Up" when
reimaging is complete.
AFter #8 it just goes back to the enable prompt. A 'sh module' lists the device as 'recover' and hangs FOREVER.... I tested the TFTP server which the new image resides on, and the TFTP is working fine. I don't see any attempts or downloads from the TFTP server for over an hour.
I opened a Ciscop TAC on this and not receiving alot of help...
Please help!!!:)
Thanks
Chris Serafin
[email protected]

The recovery using this method can takes upwards of 30 minutes, and in some cases even longer.
How long have you left the SSM in the "recovery" state?
There may be something wrong in the config you entered. when that happens the SSM can go into a continuous reboot cycle trying to do the recovery.
Execute "debug module-boot" on the console of the ASA.
The debug output will show you the ROMMON output of the SSM itself. (The SSM has it's own ROMMON. The recovery boot command sends the settings made during the recover configure command to the SSM's ROMMON).
If the ROMMON is experiencing a problem in trying to download the tftp image you should now see that ROMMON error message.
Some typical problems I have seen:
1) Wrong IP given for the sensor.
2) Wrong IP given for the gateway (the gateway must exist on the same network as the sensor) this problem usually happens when using a non-standard netmasked network.
3) Not having the sensor's command and control port plugged into the right network. The external port of the SSM itself is where the IP is being applied. You need to ensure that the extenral port of the SSM is plugged into the right network for that IP.
4) The tftp server is not reachable from the network where the sensor's command and control port is attached. Some users think that if the ASA itself can reach the tftp server that the SSM will also be able to. This is not always the case. It is best to use a tftp server on the same network as the IP provided to the SSM. Or to test the tftp server from another machine on the same network as the SSM.
5) The file name is wrong. Check the captialization especially.
6) The file is not in the default directory on the tftp server. If the file is in a subdirectory you will need to add that subdirectory to the URL:
tftp://10.20.30.40/subdirectoryname/filename
7) The tftp is timing out.
There are 2 things that can cause this:
a) The tftp server is remote, and it takes too long to download the file. The ROMMON does have limits on the number of retries and per packet timeouts (but they are not user configurable). Try using a tftp server local to the SSM.
b) The switch that the SSM connects to has spanning-tree running and spanning-tree does not complete before the SSM ROMMON times out for the tftp attempt. The tftp attempt happens immediately upon ROMMON startup and link up. But with a switch the switch port may be in a "Listen" or "Learn" state for 40 seconds before the box can actually talk on the network. In some cases the tftp download attempts started as soon as link up, and may timeout even before the spanning-tree completes. To work around this configure "spanning-tree portfast" on the switchport. Spanning-tree will connect the port into the vlan immediately rather than 40 seconds later.
If it was a config problem when configuring the recovery settings, then there is a "recover stop" command on the ASA.
It will stop the reboot cycle from happening.
Let the module come up with the old image.
Then correct your "recover configure" settings, and try the "recover boot" again.
Another alternative:
Stop the recovery "recover stop"
Let it boot into the old image.
If it was a 5.0 version, then you can actually upgrade to 5.1 using the sensor's own CLI "upgrade" command. It is actually the preferred method.
The "recover" from the ASA will wipe the box clean and load a fresh image.
The "upgrade" from the sensor will convert your 5.0 config into a 5.1 config while installing 5.1.
5.1 upgrade file:
IPS-K9-min-5.1-1g.pkg
http://www.cisco.com/cgi-bin/tablebuild.pl/ips5
It can be applied through the sensor's CLI upgrade command, or pushed directly through IDM, or applied by CSM.
The "recover" should be limited to disaster recovery. When you can't access the SSM at all, or the files on the SSM have been corrupted.
For normal upgrades you want to use "upgrade" files done through the sensor itelf (CLI, IDM, or CSM).

Oid Processing Load Percentage ASA-SSM-10

Hi Guys ,
Anybody knew the oid for Processing Load Percentage from module ASA-SSM-10 ? Because i want generate graphs in Cacti box .
Thanks
Jorge Ferreira

I don't think you can do that vai SNMP. You can script it via
the CLI tough 'show statistic virtual-sensor | inc Load'
Regards
Farrukh

Cisco WAAS MIB for CPU AND MEMORY

Hi,
I am looking to query Cisco WAAS WAVE and SRE device for basic stuff cpu, memory, interface.
I managed to get the CPU stats via SNMP using HOST-RESOURCES-MIB, however i cannot use the memory usage utilisation.
Can you please help.
Furthermore, I wanted to have some environmental values, temperature. Is there any MIB for that purpose.
Thanks

There's a "Show cpu " commmand availabe. Type help or '?' for a list of available commands.

Configure ASA-SSM-10 for Syslog

How to configure syslog on the following IPS module ?
I need to send logs from this sensor
Platform: ASA-SSM-10
Build Version: 7.0(4)E4
Os Version: 2.4.30-IDS-smp-bigphys
Can anybody advise me on this.
Regards,
Rohit

Do you need the syslogs to be sent or the Events.
IPS sensors do not support syslog forwarding. Syslog is fairly
restrictive in size of messages and is not secure or reliable.
sensor does support sending of events using SNMP
(again with the same sets of restrictions: not full data, clear text,
not reliable).
There is a physical ability to send events as traps. It isn't
recommended for many reasons (or lets say it isn't recommended in the
same way that monitoring using SDEE is). SNMP trap receivers generally
aren't built to handle, say 200 events per second per device. The
sensor isn't capable of sending at the same event rate as it is with
SDEE. The traps are in clear text and are not reliably sent. They
don't contain the same amount of info as an SDEE event, and can't.
If you need the events to be sent to a database you can run cisco IME which can collect all the events generated by the IPS.
Hope this helps.
Sachin

Hi I need OID's and the MIBs for CISCO 6504 with SUP32??

Hi I need oids and the related MIBs for cisco 6504 with supervisor 32:
Fanstatus notification, Powerstatus notification, Interface up/down, BGP notifications like peer down bgp established, ospf notifications
Thanks,
Anudeep

Fan status
CISCO-ENV-MON mib
"ciscoEnvMonFanStatusEntry"          "1.3.6.1.4.1.9.9.13.1.4.1"
"ciscoEnvMonFanStatusIndex"          "1.3.6.1.4.1.9.9.13.1.4.1.1"
"ciscoEnvMonFanStatusDescr"          "1.3.6.1.4.1.9.9.13.1.4.1.2"
Power
ciscoEnvMonSupply
S
tatusEntry"          "1.3.6.1.4.1.9.9.13.1.5.1"
"ciscoEnvMonSupplyStatusIndex"          "1.3.6.1.4.1.9.9.13.1.5.1.1"
"ciscoEnvMonSupplyStatusDescr"          "1.3.6.1.4.1.9.9.13.1.5.1.2"
"ciscoEnvMonSupplyState"          "1.3.6.1.4.1.9.9.13.1.5.1.3"
"ciscoEnvMonSupplySource"          "1.3.6.1.4.1.9.9.13.1.5.1.4"
Interface
IF-MIB
ifAdminStatus 1.3.6.1.2.1.2.2.1.7
ifOperStatus   1.3.6.1.2.1.2.2.1.8
BGP
BGP4-MIB
for the rest i will leave it to you to find the exact OIDs
use this link to find other mibs that may interest you
http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=BGP&translate=Translate&submitValue=SUBMIT&submitClicked=true

Password Reset for AIP-SSM 10

Hi,
i have an ASA5520 with v 7.2(2) running.
but the IPS module spftware is 5.1
when i tried to login to the > session 1
it prompts me for a login and password.
i tried cisco and a few other combinations.. but no luck ,,
how do i reset it ?? also that reset procedure on the docs says its resets password or the user cisco ..
how can i be sure if the user cisco even exists on it or not ?
any help please ???

no man it doesnt ..
the link u specified says it too..
hw-module module slot_number password-reset?This command recovers a password on a Cisco ASA 5500 Series Content Security and Control Security Services Module (CSC-SSM) or the AIP-SSM without having to re-image the device.
Note: This command starts support from IPS 6.0 (ASA 7.2 version) and is used to restore the Cisco CLI account password to the default cisco
hers my ASA and IPS details..
ASA# sh version
Cisco Adaptive Security Appliance Software Version 7.2(2)
Device Manager Version 5.2(2)
Compiled on Wed 22-Nov-06 14:16 by builders
System image file is "disk0:/asa722-k8.bin"
Config file at boot was "startup-config"
ASA up 22 days 3 hours
Hardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
ASA# sh module 1
Mod Card Type Model Serial No.
1 ASA5500 SSM-10 ASA-SSM-10 B155670DW4
Mod MAC Add Range Hw Ver. Fw Ver. Sw Ver.
1 00xx to 001 1.0 1.0(10)0 5.0(2)S152.0
Mod SSM Apps. Name Status SSM Apps Version
1 IPS Up 5.0(2)S152.0
Mod Status Data Plane Status Compatibility
1 Up Up

How to find useful MIBs for Cisco Devices?

Hi,
I am setting up a new Monitoring System (CA Netvoyant). It has some default Cisco monitoring capabilities ( I believe these are soem standard MIBs). I am wondering how can I add more useful Cisco MIBs for the devices I have in my network. There are thousands of MIBs and it looks like it is not easy at all to find the useful ones.
For example the MIBs that can give you Emergency and up to warning level information, cpu, memory, interface errors, module failures (in case of Cat 6500), FWSM, BGP, VPN tunnel status notifications. Is there a list of useful MIBs for each device type, like Cat 6500, ASA5540, Cat 3750-E etc depending on IOS Image?
Any help in setting up the SNMP monitoring system would be really helpful.
Thanks

If there is a MIB for it, most SNMP Capable Management servers can poll them.
This can be such as FHRP states, Routing Peers, ASA Failover status, Seriel numbers for inventory purposes.
The potential is almost endless, it just depends what you should monitor to ensure you are in the know when your network hiccups.
Here is a link to the IOS MIB Viewre
http://tools.cisco.com/ITDIT/MIBS/MainServlet
CCNP, CCIP, CCDP, CCNA: Security/Wireless
Blog: http://ccie-or-null.net/

ASA-SSM-10 Unresponsive

Hi,
I've installed an ASA-SSM-10 module into my ASA 5510 firewall but it's in "Unresponsive" state. I tried to reset and recover the module but nothing seems to work. Below you may find information about the system and details about what I did. Any help is greatly appreciated.
Firewall:
ASA5510-K8, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
System image file is "disk0:/asa843-k8.bin"
Device Manager Version 6.4(3)
IPS Module:
ASA 5500 Series Security Services Module-10 ASA-SSM-10
Hw Version: 1.0
Sw Version: 6.2(2)E4
SSM Application Version: 6.2(2)E4
I have 2 IPS images at my TFTP server:
IPS-SSC_5-K9-sys-1.1-a-6.2-2-E4.img
IPS-SSM_10-K9-sys-1.1-a-7.1-5-E4.img
I tried the command: hw-module module 1 reset
At first module status changes to "Inıt" but after then it goes back to "Unresponsive"
I used the command "hw-module module 1 recover configure" for 2 different images mentioned above by the same order and then tried:
"hw-module module 1 recover boot"
Module status changes to "Recover" and stays like that for hours. I've waited for 2 hours for 2 different images. And then I issued the command: hw-module module 1 recover stop and the module goes back to "Unresponsive" state.
The Module's network interface is connected to the same switch where the TFTP server is connected. When I run a sniffer on the TFTP server (Linux, tcpdump), there's no TFTP activity. But I can use this TFTP server from ASA (Connected to the Inside interface).
ASA Inside interface IP Address: X.X.X.1
TFTP Server IP Address: X.X.X.8
"show module 1 recover" command output:
Module 1 recover parameters...
Boot Recovery Image: Yes
Image URL:           tftp://X.X.X.8/IPS-SSC_5-K9-sys-1.1-a-6.2-2-E4.img
Port IP Address:     X.X.X.2
Gateway IP Address: X.X.X.1
VLAN ID:             0
(There are no VLANs used on this network.)

Thanks for your response. As I mentioned earlier in my email, I tried 2 different images (IPS-SSC_5-K9-sys-1.1-a-6.2-2-E4.img and IPS-SSM_10-K9-sys-1.1-a-7.1-5-E4.img) without any success. Since there are no packets coming from IPS on the TFTP server, I think the problem is something else.
When I run the "debug cplane 255" command, I see some errors mentioned below:
asa(config)# debug cplane 255
debug cplane enabled at level 255
asa(config)#
cp_connect: Connecting to card 1, socket 3, port 7000
cp_connect: Error - cp_connect() returned -1
cp_check_connection: handle -1, conflicts with connection 1 (-1)
cp_check_connection: handle -1, conflicts with connection 2 (-1)
cp_check_connection: handle -1, conflicts with connection 3 (-1)
cp_update_connection: Error updating connection_id 0
Is this a hardware issue?

Konqueror browser for Linux has an useful CPU limitation feature for websites using Flash content. Can you add such a feature in Firefox?

I have recently found that Konqueror browser for Linux can help user to limit cpu usage while visiting a website using flash technology by changing settings in the Flash section and adjusting the slider from VERY HIGH settings to HIGH and MEDIUM and so on. It actually works, and it does not have a direct impact on the general performance for flash player but it may generate some conflicts if other extensions such as add-blocker or click-to-flash are enabled also.
Maybe you can add a similar setting in Firefox in the browser option section or just as an useful addon or extension.

Sorry for being late with my reply. I've just tested that addon that you mentioned in your post ( https://addons.mozilla.org/en-US/fire.../system-monitor/ ) , it looks like a system monitor and nothing more than that.
As for the memory tip ( about:memory ) I agree that it can be extremely useful for users that have less than 1 gb memory installed on their system. I know very little about computers but I can tell your tip for optimizing memory usage in firefox has merits.
Me, I have another problem with cpu overload in Firefox, Internet Explorer, Opera and most of the browsers with flash support enabled. Each and every time time I visit a page that features all sort of adds and gadgets based on flash technology, and each time I try to watch a video online my cpu goes all the way up to 100% and stays there until i finally decide to close the browser.
I am running winxp and also linux on a Dell Optiplex GX260 machine with 2000 MHz cpu, 1024 Mib ram and 128 Mib video card, it is not the best computer in the world but still 2000 MHz should be enough for a limited and uneventful web experience.
It is not as much an issue with the web browser, any browser, the whole problem is caused by funny people claiming to be deeply involved with web development, and promoting flash technology for ages instead of choosing other alternatives, more user friendly. All I am saying is that flash ruined the entire web experience making people to believe that they actually need dual-core cpu and coreduo and deepfreeze cpu and so on which is only partially true.
I always get better results for cpu usage when watching online videos that use media player as default player and not flash player, and my cpu stays below 70% usage which is not much but still it is not 100% usage.
Konqueror offered me a nice surprise, and I was able to limit cpu usage once I moved that slider from Very High setttings for flash player to Medium settings. I got something between 80-90% cpu usage as a result, and I was very pleased to finally see a working solution to my problem at least for linux if not for windows.
The only other browser that I can use for windows only, which handles both flash player and cpu usage well is Kmeleon browser which is a long forgotten project but does offer nice features once you find some plugins that it needs to make it come to life again.

How to do a factory reset ASA-SSM-10?

Hi.
I forgot the user for management a IPS SSM-10, when i follow the procedure to reset the password for cisco user, i can get into the module, i change the password and every thing is OK, but when i tried to configure y don´t have rights to do anything.
if i see the privileges for the user cisco this is the result
EDGE-IPS2# sh user
    CLI ID   User    Privilege
*   4143     cisco   viewer
Application Partition:
Cisco Intrusion Prevention System, Version 6.1(1)E2
Host:
    Realm Keys          key1.0
Signature Definition:
    Signature Update    S364.0                   2008-10-24
    Virus Update        V1.4                     2007-03-02
OS Version:             2.4.30-IDS-smp-bigphys
Platform:               ASA-SSM-10
Serial Number:          JAF1208BNPP
License expired:        20-Jun-2009 UTC
Sensor up-time is 1:09.
Using 657850368 out of 1032495104 bytes of available memory (63% usage)
system is using 17.7M out of 29.0M bytes of available disk space (61% usage)
application-data is using 41.5M out of 166.8M bytes of available disk space (26% usage)
boot is using 40.5M out of 68.6M bytes of available disk space (62% usage)
MainApp          M-2008_APR_24_19_16    (Release)   2008-04-24T19:49:05-0500   Running
AnalysisEngine   ME-2008_JUN_05_18_26   (Release)   2008-06-05T18:55:02-0500   Running
CLI              M-2008_APR_24_19_16    (Release)   2008-04-24T19:49:05-0500
Upgrade History:
* IPS-K9-6.1-1-E2           22:40:50 UTC Tue Feb 26 2013
IPS-sig-S364-req-E2.pkg   18:43:20 UTC Wed Nov 12 2008
Recovery Partition Version 1.1 - 6.1(1)E2
Host Certificate Valid from: 17-Nov-2008 to 18-Nov-2010
What can i do in this case?
IPS Info
Getting details from the Service Module, please wait...
ASA 5500 Series Security Services Module-10
Model:              ASA-SSM-10
Hardware version:   1.0
Serial Number:      JAF1208BNPP
Firmware version:   1.0(11)4
Software version:   6.1(1)E2
MAC Address Range: 001e.f710.5b6c to 001e.f710.5b6c
App. name:          IPS
App. Status:        Up
App. Status Desc:
App. version:       6.1(1)E2
Data plane Status: Up
Status:             Up
Mgmt IP addr:       X.X.X.X
Mgmt web ports:     443
Mgmt TLS enabled:

The process will normally use the following command:
hw-module module 1 password-reset
It will reload the ASA and when loggin back the "Cisco" username will have admin rights.
If this is not your case, a re-image of the unit will be the next step, keep in mind that this will remove all the custom config.

CPU OID MIB for ASA-SSM-10

Similar Messages

Maybe you are looking for