Filter
Top Products
18-10
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 18 Configuring the ASA 5500 AIP SSM
Sending Traffic to the ASA 5500 AIP SSM
Sending Traffic to the ASA 5500 AIP SSM
Note This section applies to Cisco Adaptive Security Appliance Software 7.2 or earlier for
ASA 5500 AIP SSM.
This section describes how to configure ASA 5500 AIP SSM to receive IPS traffic from the adaptive
security appliance (inline or promiscuous mode) if it is running Cisco Adaptive Security Appliance
Software 7.2 or earlier. It contains the following topics:
• Adaptive Security Appliance and the ASA 5500 AIP SSM, page 18-10
• Configuring the Adaptive Security Appliance to Send IPS Traffic to the ASA 5500 AIP SSM,
page 18-10
Adaptive Security Appliance and the ASA 5500 AIP SSM
The adaptive security appliance diverts packets to ASA 5500 AIP SSM just before the packet exits the
egress interface (or before VPN encryption occurs, if configured) and after other firewall policies are
applied. For example, packets that are blocked by an access list are not forwarded to
ASA 5500 AIP SSM.
You can configure ASA 5500 AIP SSM to inspect traffic in inline or promiscuous mode and in fail-open
or fail-over mode. You can use the adaptive security appliance CLI or ASDM to configure IPS traffic
inspection.
Perform these steps on the adaptive security appliance to identify traffic to be diverted to and inspected
by ASA 5500 AIP SSM:
1. Create or use an existing ACL.
2. Use the class-map command to define the IPS traffic class.
3. Use the policy-map command to create an IPS policy map by associating the traffic class with one
or more actions.
4. Use the service-policy command to create an IPS security policy by associating the policy map with
one or more interfaces.
Configuring the Adaptive Security Appliance to Send IPS Traffic to the ASA 5500
AIP SSM
To send traffic from the adaptive security appliance to ASA 5500 AIP SSM for the IPS to inspect, follow
these steps:
Step 1 Log in to the adaptive security appliance.
Step 2 Enter configuration mode.
asa# configure terminal
Step 3 Create an IPS access list.
asa(config)# access-list IPS permit ip any any