Filter
Top Products
18-5
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 18 Configuring the ASA 5500 AIP SSM
Creating Virtual Sensors for the ASA 5500 AIP SSM
ASA 5500 AIP SSM Virtual Sensor Configuration Sequence
Follow this sequence to create virtual sensors on the ASA 5500 AIP SSM, and to assign them to adaptive
security appliance contexts:
1. Configure up to four virtual sensors.
2. Assign the ASA 5500 AIP SSM sensing interface (GigabitEthernet 0/1) to one of the virtual
sensors.
3. (Optional) Assign virtual sensors to different contexts on the adaptive security appliance.
4. Use MPF to direct traffic to the targeted virtual sensor.
Creating Virtual Sensors
Note You can create four virtual sensors.
Use the virtual-sensor name command in service analysis engine submode to create virtual sensors on
the ASA 5500 AIP SSM. You assign policies (anomaly detection, event action rules, and signature
definition) to the virtual sensor. You can use the default policies, ad0, rules0, or sig0, or you can create
new policies.Then you assign the sensing interface, GigabitEthernet 0/1 for the ASA 5500 AIP SSM to
one virtual sensor.
The following options apply:
• anomaly-detection—Specifies the anomaly detection parameters:
–
anomaly-detection-name name—Specifies the name of the anomaly detection policy.
–
operational-mode—Specifies the anomaly detection mode (inactive, learn, detect).
Note Anomaly detection is disabled by default in IPS 7.1(2)E4 and later. You must enable it
to configure or apply an anomaly detection policy. Enabling anomaly detection results
in a decrease in performance.
• description—Provides a description of the virtual sensor.
• event-action-rules—Specifies the name of the event action rules policy.
• signature-definition—Specifies the name of the signature definition policy.
• physical-interfaces—Specifies the name of the physical interface.
• no—Removes an entry or selection.
Creating Virtual Sensors
To create a virtual sensor on the ASA 5500 AIP SSM, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Enter service analysis mode.
sensor# configure terminal
sensor(config)# service analysis-engine
sensor(config-ana)#