Do any ASA Inspect statements overlap AIP-SSM functionality?

Are the ASA inspect statements (http,ftp, sunrpc, etc) a duplication of functionality available in the AIP-SSM IPS module? Asked another way, can/should any of the inspect statements be turned off when the AIP-SSM is present?

http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a0080640337.html#wp1313159

Similar Messages

  • How ASA forwarding traffic to AIP-SSM

    Hi All,
    Can someone help how ASA device forwarding traffic to AIP-SSM? I'm not taking abt Configuration part like Class-map, policy-map and service policy....want to understand the traffic flow from ASA once traffic matched with ACL to AIP-SSM.
    From one of Cisoc document, understood that the module using a Cisco Propietary protocol for communicating with ASA appliance.
    ================================================================================================================
    FYR from Cisco Website:
    Q. How does the Cisco ASA AIP-SSM plug into and communicate with the appliance?
    A. The Cisco ASA AIP-SSM plugs directly into the SSM slot in the Cisco ASA appliance's chassis. This provides a direct connection to the appliance's backplane. Once the module is installed, a proprietary protocol runs over the bus and controls data flow and messaging between the module and appliance.
    ================================================================================================================
    Regards,
    S.Vinoth

    Hey ,
    as you mentioned above , it uses a cisco Probietary protocol for that communication , there are two interfaces , control channel and data channnel , data channel is where the traffic being forwarded , the backplane is the connection between the ASA and the IPS interface .
    Hope that this helps .
    Mohammad.

  • ASA failover with 1 AIP SSM in Active/Standby?

    I have a customer with two ASAs; in Active/Standby. They want to purchase one AIP. Will failover (without the AIP functionality) to the Standby work if the AIP is configured for Promiscuous mode? Thanks, Bob

    The only connection to the SSM that can be done internally through the ASA is a "session". This is an internal telnet to the SSM and can be used to access the SSM's CLI.
    This is very usefull when you manage your SSM directly through the CLI.
    However, most customers prefer to use a graphics based tool like IDM, ASDM, or CSM for managing the configuration of the SSM, and prefer to use a graphics based tool like IEV or CS MARS for monitoring of the alerts from the SSM.
    All of these graphics based tools need network access to the SSM through a web port (https on port 443 by default). Access to this port is not allowed internally through the ASA direct to the SSM.
    All web connections must be made to the External Management interface of the SSM.
    If you are not using all 4 of your ASA interfaces you could choose to wire the External SSM interface directly to one of your ASA interfaces, and create a small subnet for the ASA and IPS IP Addresses. So then all external connections to the SSM would be routed into the ASA, then out of the ASA, and into the external port of the SSM.
    That subnet of just the ASA and SSM could be made using a network reserved for local IPs (like a 10, or 172, or 192 network) and then use NAT/PAT for translation on the other network interfaces of the ASA.
    But it does still require that wire connected to the external port of the SSM.

  • Transparent mode with AIP-SSM-20

    I currently have an ASA5510 in routed mode with an AIP-SSM-20.
    There is a requirement to use a fibre optic connection between this ASA and another ASA across campus, so the AIP-SSM will have to be removed and replaced with the SSM-4GE.  This part should present no issue.
    However, this will remove the IPS device, and I still want to use IPS.
    So, what I am thinking is to get another ASA5510, install the AIP-SSM, configure ASA for transparent mode and put it in between the inside of the routed ASA and my LAN.  The transparent ASA would be functioning strictly as an IPS appliance.
    Setup would look something like this:
    Internal LAN <> transparent ASA with IPS <> routed ASA <> WAN
    Can the AIP-SSM still perform IPS with the ASA in transparent mode?
    Is there a way to configure the ASA and AIP-SSM such that traffic to/from a particular server completely bypasses the AIP-SSM?
    I have a couple of fileservers that generate heavy traffic and could overload the AIP-SSM.
    Regards.

    AFAIR, There is no problem to setup AIP in a transparent firewall.
    "An ASA in transparent mode can run an AIP.  In the event the AIP fails,
    the IPS will fail-open and the ASA will continue to pass traffic.
    However, if an interface or cable fails, then traffic will stop.  You
    would need a failover pair to account for this failure event, which
    means another ASA and matching AIP."
    And no there is no problem to exclude certain hosts/ports/subnets from inspection by IPS via MPF.
    http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ips.html#wp1050744
    What I however consider however is if the ASAs 5510 as second tier firewall for 5520s will be enough.
    http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html
    HTH,
    Marcin

  • AIP-SSM-10 status: Unreponsive

    Hye All,
    wish to know what can result in an AIP-SSM-10 to be in an unreponsive mode.
    Thanks ye all.

    Power cycle the ASA. If the AIP-SSM console port doesn't come back to life, RMA it with a Cisco TAC case.
    - Bob

  • Cisco IPS 4240 VS Cisco ASA AIP SSM-10 Modula

    I'm looking to replace another vendor's IPS system we have at our company. We do have an ASA 5510 in our envionment currently.
    Considering I don't need the extra bandwidth of the IPS 4240 series and the AIP SSM-10 requires an ASA 5510 what are the differences?

    Operationally the AIP-SSM1 and the 4240 run the same software, so they work pretty much the same.
    The AIP-SSM inside the ASA is less expensive alternateive, but becuase it sits inside an ASA there is more to configure and manage (the ASA plus the sensor), The ASA also has some built in inspections that may filter some traffic/attacks from being seen at the AIP-SSM sensor.
    - Bob

  • Is there any architectural difference between CSC-SSM and AIP-SSM modules

    Hello security gurus!
    I'm wondering if there's any chance to make Content security module (CSC-SSM) work as IPS (AIP-SSM). It seems to me they are absolutely identical in terms of hardware. Is there any chance to make CSC-SSM boot with the flash from AIP-SSM and have the ASA recognize it as an IPS module ?
    Eugene

    Zheka,
    This is not recommended and you will loose support, these are different devices designed for different purposes, you will also have issues with the license, I have seen it one once, and the customer did it by mistake, the module eventually crashed and we had to add the proper image.
    Regards,
    Felipe.

  • Single AIP-SSM in Cisco ASA Failover Active / Standby Mode

    Hi,
    I can add single AIP-SSM on Cisco ASA in failover active / standby mode?

    No, both units need the same hardware, that includes the installed modules.
    Sent from Cisco Technical Support iPad App

  • IPS Signature DataBase - ASA IPS/IOS IPS/IPS 42xx/AIP-SSM

    Hi,
    Can anyone briefly tell me the signature database details (No of Signature) among the following devices,
    -->ASA IPS/IOS IPS/IPS 42xx/AIP-SSM.
    Thanks,

    IPS on ASA/PIX = just 50 or so common signatures
    AIP-SSM module = same signatures as Cisco 4200 series sensors. Little minor differences exist (like IPv6 signature support etc.)
    Please rate if helpful.
    Regards
    Farrukh

  • Will the AIP-SSM for the ASA stop this?

    I have a client emailed me today that someone did a script injection attack on one of their web servers. It ran a backdoor Trojan virus on their web server. I know the AIP-SSM will stop the Trojan, but will it stop someone from doing the script injection attack. If so, is it documented and can you point me to the document.
    Thanks.
    Dan

    Hi,
    If you know exactly which of the various script injection attacks was used you can simply look it up here:
    http://tools.cisco.com/security/center/home.x
    If you don't know exactly which one then it's slightly harded to know whether it would have been stopped, but searching on "script injection" or similar should narrow down the candidates and give you an idea on whether it would have been stopped or not.
    Remember that an IPS isn't perfect, but it *will* significantly lower your risk if setup and maintained properly.
    HTH
    Andrew.

  • AIP-SSM How to Verify Traffic is being passed for inspection?

    "show conf" command on my AIP SSM CLI. gigabitEthernet0/1 backplane interface of the SSM has not been assigned to virtual sensor vs0.but
    Through this command show service-policy
    traffic is recevied by IPS Module.why this,
    Kindly guide me

    Thanks,i got it.
    Cinet-IPS1# show statistics virtual-sensor
    Virtual Sensor Statistics
    Statistics for Virtual Sensor vs0
    Name of current Signature-Defintion instance = sig0
    Name of current Event-Action-Rules instance = rules0
    List of interfaces monitored by this virtual sensor = GigabitEthernet0/1 subinterface 0
    General Statistics for this Virtual Sensor
    Number of seconds since a reset of the statistics = 434653
    SensorApp Memory Use Percentage = 33
    Processing Load Percentage = 1
    Total packets processed since reset = 1722
    Total IP packets processed since reset = 1722
    Total IPv4 packets processed since reset = 1722
    Total IPv6 packets processed since reset = 0
    Total IPv6 AH packets processed since reset = 0
    Total IPv6 ESP packets processed since reset = 0
    Total IPv6 Fragment packets processed since reset = 0
    Total IPv6 Routing Header packets processed since reset = 0
    Total IPv6 ICMP packets processed since reset = 0
    Total packets that were not IP processed since reset = 0
    Total TCP packets processed since reset = 1466
    Total UDP packets processed since reset = 0
    Total ICMP packets processed since reset = 256
    Total packets that were not TCP, UDP, or ICMP processed since reset = 0
    Total ARP packets processed since reset = 0

  • AIP-SSM 20 questions

    Hi,
    we have this module on an ASA 5540, while the inspection load is reaching a max of 35% , the cpu is reaching 100% sometimes.
    1- how do i check the current bandwidth in Mbs being inspected ?
    2- how do i check if there is drops when cpu is reaching 100%
    3-if cpu hangs at 100% will fail-open work or will the module start dropping legitimate packets
    4- should i upgrade my card to AIP-SSM 40 allthough inspection load is still 35% ?
    Thank you

    To check if your sensor is dropping packets, get on the CLI and run
    show interface - This will show you an averaged packet loss across all interfaces since last reset and on a per-interface basis.
    show event stat past 01:00 inc missed - This will show you any peaks in your missed pckets over the last hour.

  • Configuring SNMP Trap receiver on AIP-SSM sensor

    I receive the following error message from my ASA5520 firewall when attempting to forward SNMP traps from my AIP-SSM20 sensor to a server on my Inside interface that is configured to receive SNMP traps:
    ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src management: 10.3.21.2/32768 dst Inside: PPC0ES/162
    Can I reconfigure the management IP address of the AIP-SSM sensor to connect to the Inside interface instead of the management vlan or does my SNMP server have to reside on the management vlan with the sensor?

    Hi Subodh,
    Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
    If you have any other specific questions, feel free to post back.
    Hope that helps.
    -Mike

  • AIP-SSM configuration assistance

    I have two questions regarding the AIP-SSM.
    1) Does the ACL on AIP-SSM have any type of relations to the ASA ACL?
    2) Our four interfaces are all in use. Is it possible to assign the SSM an IP address in the same subnet as the management interface?
    3) Should then the management interface be used as the gateway for the SSM?
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 65.x.x.1 255.255.255.0 standby 65.x.x.2
    interface GigabitEthernet0/1
    nameif dmz
    security-level 50
    ip address 172.16.x.1 255.255.255.0 standby 172.16.x.2
    interface GigabitEthernet0/2
    nameif inside
    security-level 100
    ip address 192.168.x.1 255.255.255.0 standby 192.168.x.2
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    speed 100
    duplex full
    nameif management
    security-level 100
    ip address 10.0.x.1 255.255.255.0 standby 10.0.x.2
    management-only

    Here are the answers to your questions-
    1) Does the ACL on AIP-SSM have any type of relations to the ASA ACL?
    Ans) No. ACL on SSM is completely independent of ACLs on ASA.
    2) Our four interfaces are all in use. Is it possible to assign the SSM an IP address in the same subnet as the management interface?
    Ans) Absolutely. You can assign the management port of SSM an IP in the same subnet as your managemnet interface. That way all management traffic will be kept independent of normal DATA traffic.
    3) Should then the management interface be used as the gateway for the SSM?
    Ans) You are right .. :-)
    Hope that helps.
    Regards,
    Vibhor.

  • Configuring AIP-SSM modelue

    hi,
    we have AIP-SSM-40 modeule installed on ASA 5540 but it is just physically present.
    Is it possible to configure to this modeule in inline or like IDS mode? It has only one Ethernet interface. Can this interface be treated as sensor interface and mark a copy of all incoming frames on this interface ( by SPA on switches ).
    Please share the experience.
    Thanks in advance.
    Subodh

    Hi Subodh,
    Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
    If you have any other specific questions, feel free to post back.
    Hope that helps.
    -Mike

Maybe you are looking for