New to IPS SSM 10

Can i know the link where i can get the guide how to work on IPS SSM 10 (cisco IDM 6.0)

Configuring the AIP-SSM, IPS CLI Config Guide v6.0
http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliSSM.html
Troubleshooting the ASA AIP-SSM
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00808908d5.shtml
Sending traffic from ASA to AIP-SSM config example
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
Deploying IPS using the AIP-SSM
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/white_paper_c11-459025_ps6120_Products_White_Paper.html
Getting started guide ASA v8.0 configuring the AIP-SSM
http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5500/quick/guide/aipssm.html
initialize the AIP-SSM
http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliInit.html#wp1043876
installing the AIP-SSM system image
http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliImage.html#wp1032373

Similar Messages

Syslog support for IPS SSM 10

Hi,
I am new to IPS SSM 10. i've few questions:
1.Do we have any kind of syslogs logs for IPS SSM 10? basically i want to know what kind of attacks, intrusion & DoS has happened.
2.Can we update the Signature automatically thru Cisco site?

The AIP-SSM does not support syslog as an alert format.
The default method to receive alert information from the AIP-SSM is through Security Device Event Exchange (SDEE). Another option is to configure individual signatures in order to generate a SNMP trap as an action to take when they are triggered.

Initial hookup of IPS-SSM in an ASA to a switch

                   I have an ASA-5520 with a IPS-SSM-40. I configured the IPS control port to an ip address on the ASA's inside network subnet and connected it to the same switch as the ASA's inside port is connected to. I am using a single context. What vlan should the switch port be on that connects to the IPS?
I can SSH to the ASA and go to session 1 and see the config. But I cannot connect thru the ASDM.
ASA 5500 Series Security Services Module-40
Model:              ASA-SSM-40
Hardware version:   1.0
Serial Number:      JAF1545CBNM
Firmware version:   1.0(14)5
Software version:   6.0(6)E4
MAC Address Range: 44d3.ca0f.0413 to 44d3.ca0f.0413
App. name:          IPS
App. Status:        Up
App. Status Desc:
App. version:       6.0(6)E4
Data plane Status: Up
Status:             Up
Mgmt IP addr:       192.168.0.12
Mgmt web ports:     443
Mgmt TLS enabled:   true MAC Address Range: 44d3.ca0f.0413 to 44d3.ca0f.0413
App. name:          IPS
App. Status:        Up
App. Status Desc:
App. version:       6.0(6)E4
Data plane Status: Up
Status:             Up
Mgmt IP addr:       192.168.0.12
Mgmt web ports:     443
Mgmt TLS enabled:   true

The config that you have earlier should already allow access to the IPS via AnyConnect. Pls remove the config that you have just added as it sounds incorrect.
Can you ping the IPS from the AnyConnect client?
I assume that you can ping 192.168.0.31 and 192.168.0.4 when you are connected via AnyConnect, right?
If you can, then you should be able to ping 192.168.0.12 as well. I also assume that the port on the module is connected to the same switch where the ASA inside interface is connected.
Can you install a TFTP server on a host on your inside network, and transfer the image to the IPS module via an inside host. I assume you can RDP to an inside host once you are connected via AnyConnect.

ASA 5510 8.4(2) and IPS SSM-20 7.0(6) E4

Hi, I'm thinking the ASA 5510, ver. 8.4(2) with IPS SSM-20 ver. 7.0(6) E4 falls into IPS unresponsive state.
Now I'm testing the ASA 5510 ver. 8.4(2) with IPS SSM-20 ver. 7.0(4) E4, to verify if the system falls into the same condition.
Any experience ?
In case of incompatibility, how to downgrade ISP SSM-20 to 7.0(4) ?
thanks
rs

You may remove last signature update or service pack by using "downgrade" command in config mode on IPS CLI:
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_system_images.html
"Downgrading removes the last applied service pack or signature update from the sensor."

IPS SSM 20 software upgrade

Hi ,
What is the latest version in IPS ssm 20 software,? and what is the procedure to upgrade that??
Regards
Mambo

Have you ever searched for and downloaded a router software update?
If you have,it works just like that.
The latest version of software is IPS-SSM_20-K9-7.1-8-E4.pkg
If you have a vaild license you'll also want to apply the latest signature pack (as of today it is)
IPS-sig-S754-req-E4.pkg
If you have a CCO account you can find them both here:
http://software.cisco.com/download/type.html?mdfid=280432811&flowid=29561
- Bob

Cisco ips ssm -- with cisco IME -- logs

Hi, can any one tell me how do i pull the logs from SSM mo
dule to the cisco IME server for log analysis.
i know that syslog is not supported in SSM and the only option is to have IME server...
-Rajesh

You will need to add the IPS-SSM module to your IME, and it will automatically pull logs from the module once it has been added to your IME.

Cisco ASA IPS SSM-10

Hello,
I just upgraded one of my Cisco ASA IPS SSM-10 from version 7.0 (6) E4 to version 7.0 (7) E4 and the Radius authentication stopped working. I use Microsoft 2008 Radius and I still have 10 more of these working with version 7.0 (6) E4.
I used to have the same Radius authentication issue with version 6 until we upgraded to ver 7.0 (6) E4 and this latest version screwed up again.
Does anyone know if there is a Radius authentication bug in this latest version 7.0 (7) E4?
Thank you
Si

There is a known issue CSCty46104. However a show-tech log can give more details as to why there was a failure in your case.
Regards
Sawan Gupta

Does IPS SSM affected by the Shellshock bug?

Anybody knows if the independent IPS appliance is only affected or also the IPS SSM installed on a cisco ASA are vulnerable?
Thanks

According to this, yes its vulnerable:
https://tools.cisco.com/bugsearch/bug/CSCur00552

Had a bad IPS SSM-20 RMA for new one now license needs to be transfered?

Now the licence for the IPS on my account service contract is different from the one installed. the serial numbers are different? How can I get the one I returned via RMA and have a license for the new serial number?

Use your open TAC case to request the license be transferred. It should have been done automaticly when your unit was RMA'ed, but if not just ask your TAC engineer to do it.
- Bob

New to IPS, what do I need to plan before I turn this on?

Hi, I have an ASA 5520 AIP-SSM 10. I'm having a consultant in to enable and upgrade our IPS on our ASA from 1.5 to 1.6 so it's intergrated into the ASDM (sounds difficult). He said I need to plan what policies we need to enable for the interfaces and DMZ's etc.
This is very new to me and I wondered if this is right, as it sounds bigger than I first thought. Basically I want my network to my as secure as possible and turning on the IPS we bought is needed.
Any advise, links etc would be most welcome.

Go to cisco.com, put this into the search field, download the pdf and read all 799 pages.
Configuring the Cisco Intrusion Prevention
System Sensor Using the Command Line
Interface 6.0
Sorry to be the bearer of bad news, but that is the only way to truly understand this enigmatic box.
Matt

New to IPS 4240 - What else can I use to manage it?

I have just purchased a Cisco IPS 4240 and have it up and running. Have been using the IEV to view IPS information and that works ok. The VMS 2.2 that came included with the IPS will not work with the current Cisco works (LMS 2.5) installation that we have.
My question is, is there any other tool besides the IEV and the VMS 2.2 that I can use to mange/monitor my IPS? the IEV seems so limited.
I have downloaded the newer VMS from the Cisco site and am planning to test that this comming week, but wanted to know ahead of time if I needed to waste my time with this tool or not.
Thanks!

The latest CSMARS release is promising and honestly the netforensics solution offered by Cisco probably wouldn't be a good fit for the op, but I think Cisco needs to rething pushing the MARS in leui of everything else. As a previous customer of netforensics, and now a user of CSMARS...there are definitely many things that netforensics does better than CSMARS.
My biggest beef with CSMARS is the seemingly casual way in which it treats time and "raw messages". IMHO, these should be sacred to any SIM. I can elaborate, but for the sake of brevity I'll just give a couple examples:
The signature name reported in the "raw message" that MARS makes available is not always correct. Also, custom signature events report as "unknown" in the "raw message". Clearly this is not a "raw message" by any reasonable interpretation...MARS is writing bits that never existed in the original message.
the event contextual information is very often truncated. If you rely on this a great deal, the MARS probably isn't for you. There's also no interface for decoding it, requiring a cut-and-paste into your favorite decoder.
Believe me, I could go on. On the bright side, the MARS is showing promise...I was able to cross off my list quite a few issues after the latest upgrade.
Matt

New SourceFire IPS for ASA firewalls

I am in the process of ordering numerous ASA firewalls up to the 5585X models complete with IPS
I just found out that Cisco is now using SourceFire/Firepower for these, and is probably going to discontinue the old system.
I don't see a whole lot of documentation on this new system, and many of the links on the Cisco website simply link back to the old Sourcefire company page. So I had some general questions
1. How radically different is the new IPS/IDS system? Is it still based on signatures, threat ratings, etc.?
2. Where can I go to find documentation on this? Any books? PDFs?
3. How long has this been out? Has it been real-world tested?
4. can I manage these IPS systems with IME, or do I need new software? What about ASDM?

> I just found out that Cisco is now using SourceFire/Firepower for these, and is probably going to discontinue the old system.
The legacy IPS is already announced for EOS/EOL.
> 1. How radically different is the new IPS/IDS system? Is it still based on signatures, threat ratings, etc.?
It's still mainly a signature-based system, more or less same as before. Expect an easier tuning and better defaults then before.
> 2. Where can I go to find documentation on this? Any books? PDFs?
Not that easy, Beside the infos on the cisco website the are also trainings like the SASAA 1.2 that start to integrate FirePower. But there it's only one topic of many.
> 3. How long has this been out? Has it been real-world tested?
As an IPS it probably deserves the status "real-worls tested". As a cisco-integrated system, well, I would say it's on the way.
> 4. can I manage these IPS systems with IME, or do I need new software? What about ASDM?
no IME any more! You use the FireSight Management-Center (appliance or VM). I heard that ASDM-integration is planned, but I wouldn't expect that anytime soon.

Cisco IPS SSM 10 Sensor can't update signature file from ASA 5510

Cisco ASA 5510 IPS Firewall with ASA-SSM-10 Module. I am trying to do a manual update of the signature file and get the following error:
Error: execUpgradeSoftware : couldn't connect to host
I have confirmed that I can ping the ftp server successfully from the ASA and the command I am trying to use from the configure terminal of the module is:
upgrade ftp://[email protected]//IPS-sig-S813-req-E4.pkg
I have also tried via http and it does not work as well. Any thoughts?

to connect to ftp there should be username usually anonymous and password whitch can be any. check in ftp server
aip_ssm_card# copy ftp://192.168.15.12/JAF1308ARNJ_20131009032200919.lic license-key
User: anonymous
Password: *********
the username and/or the password are incorrect
aip_ssm_card# copy ftp://192.168.15.12/JAF1308ARNJ_20131009032200919.lic license-key
User: 123
Password: ***
File opening error
I made special user 123 on ftp server with password 123
aip_ssm_card# copy ftp://192.168.15.12/JAF1308ARNJ_20131009032200919.lic license-key
User: 123
Password: ***
aip_ssm_card#
and dont forget to rate post

New Features in SSM 10.1 SP5

Strategy Management 10.1 SP5 is available for download and includes multiple functional enhancements.
Group access for Reports/Dashboards/Briefing Books
Ability to manage drafts and "publish" Briefing Books
Internet Explorer 11 support
Semi-Annual periodicity option to Scorecards/Reports
iPad enhancements
Briefing Books tab added when viewing SSM in iPad
Ability to create and edit Initiatives and Milestones
Ability to add Comments

Chris,
Has the semi-annual capability also been included in Entry and Approval?
Is there anything other than the checkbox on the Administration Set Defaults page that needs to be enabled?
We're trying to add semi-annual KPIs into a model but the metrics are not showing up in the left hand selector box on the E&A Defaults page!
Regards
Colin

Hi Friends,help in purchasing new cisco IPS

Hi Friends,
                I am working as a network admin in a telecom based company and we have two lease
                line of of 2mb and 1 mb bandwidth resp.I have a cisco asa 5510 and i want to purchase a cisco IPS.
                I am very fresh to this security field so pls kindly suggest me which series of
                cisco IPS is suitable for my comp network.
Any kind of help is appreciated.
                                                  Thankx a lot in advance.

Hii Arghadip,
i have given my friend user id,i checked in workplace,it was not ther friend...how can i rectify this problem..
awaiting for your reply buddy.
Regards
Raju Aitha

New to IPS SSM 10

Similar Messages

Maybe you are looking for