Solved: Does getting a Smartnet contract also give you IDS/IPS signature updates?

thomasdzubin · ‎09-19-2007

A client of mine is looking into getting an ASA5510 with AIP-SSM module. I realize that with IDS/IPS systems, it is *crucial* to always keep signature files up-to-date. Does purchasing the Smartnet contract for the bundle give me signature file updates or is there some other package I need to buy?

I see references to "Cisco Services for IPS" but that seems to be mainly for router/IOS-based firewall/IDS packages.

marcabal · ‎09-19-2007

There is not a Smartnet contract for the ASA/AIP-SSM bundle.

The only SmartNET contract for SSM bundles are with the CSC-SSM and not the AIP-SSM.

When purchasing an ASA/AIP-SSM bundle you will need to purchase a bundle maintenance contract. The bundle maintenance contracts are Cisco Service for IPS contracts and include the signature support for the AIP-SSM as well as the software and hardware support on both the AIP-SSM and ASA (the software and hardware support is what it is normally part of SmartNET).

For the bundles you will want to purchase a Cisco Service for IPS maintenance contract using one of the following part number formats:

CON-SUw-ASxAyKz

The "w" will be either 1,2,3, or 4 depending on the level of service.

The "x" will be either 1 for the 5510, 2 for the 5520, or 4 for the 5540.

The "y" will be either 10 for the AIP-SSM-10, or 20 for the AIP-SSM-20.

The z will be either 8 or 9 depending on the encryption level.

So for example:

CON-SU2-AS2A20K9 - Would be 8X5X4 support for the ASA-5520 bundled with the AIP-SSM-20 with the higher encryption.

NOTE: There are also SP contracts for purchase by Service Providers that follow a slightly different format.

There are a few users who have purchased the ASA and AIP-SSM separately.

When purcahsed separately you would need to purchase a SmartNET contract for the ASA, and a separate Cisco Service for IPS maintenance contract for the AIP-SSM.

The AIP-SSM maintenane contract will be in the following format:

CON-SUw-ASIPyK9

The "w" will be either 1,2,3, or 4 depending on the level of service.

The "y" will be either 10 for the AIP-SSM-10, or 20 for the AIP-SSM-20.

So for example:

CON-SU2-ASIP20K9 would be 8X5X4 support for the AIP-SSM-20.

What you will find is that purchasing a separate SmartNET for the ASA and Cisco Service for IPS for the AIP-SSM will be more expensive than purchasing a single Cisco Service for IPS for the ASA/AIP-SSM bundle. This is because there is a discount when purchasing by the bundle.

View solution in original post

marcabal · ‎09-19-2007

There is not a Smartnet contract for the ASA/AIP-SSM bundle.

The only SmartNET contract for SSM bundles are with the CSC-SSM and not the AIP-SSM.

When purchasing an ASA/AIP-SSM bundle you will need to purchase a bundle maintenance contract. The bundle maintenance contracts are Cisco Service for IPS contracts and include the signature support for the AIP-SSM as well as the software and hardware support on both the AIP-SSM and ASA (the software and hardware support is what it is normally part of SmartNET).

For the bundles you will want to purchase a Cisco Service for IPS maintenance contract using one of the following part number formats:

CON-SUw-ASxAyKz

The "w" will be either 1,2,3, or 4 depending on the level of service.

The "x" will be either 1 for the 5510, 2 for the 5520, or 4 for the 5540.

The "y" will be either 10 for the AIP-SSM-10, or 20 for the AIP-SSM-20.

The z will be either 8 or 9 depending on the encryption level.

So for example:

CON-SU2-AS2A20K9 - Would be 8X5X4 support for the ASA-5520 bundled with the AIP-SSM-20 with the higher encryption.

NOTE: There are also SP contracts for purchase by Service Providers that follow a slightly different format.

There are a few users who have purchased the ASA and AIP-SSM separately.

When purcahsed separately you would need to purchase a SmartNET contract for the ASA, and a separate Cisco Service for IPS maintenance contract for the AIP-SSM.

The AIP-SSM maintenane contract will be in the following format:

CON-SUw-ASIPyK9

The "w" will be either 1,2,3, or 4 depending on the level of service.

The "y" will be either 10 for the AIP-SSM-10, or 20 for the AIP-SSM-20.

So for example:

CON-SU2-ASIP20K9 would be 8X5X4 support for the AIP-SSM-20.

What you will find is that purchasing a separate SmartNET for the ASA and Cisco Service for IPS for the AIP-SSM will be more expensive than purchasing a single Cisco Service for IPS for the ASA/AIP-SSM bundle. This is because there is a discount when purchasing by the bundle.

thomasdzubin · ‎09-19-2007

Thanks! That is EXACTLY the info that I need.

tonypto · ‎09-24-2007

Does that mean if I have CON-SU3-AS2A20K9, I would not need to purchase a CON-SUSW-AS2A20K9 to get the signature support?

marcabal · ‎09-24-2007

I could not find any mention of a CON-SUSW-AS2A20K9.

Did you mean to say CON-SUSA-AS2A20K9??

NOTE the difference between SUSW and SUSA in the part number.

Either way the CON-SU3-AS2A20K9 (or SU1, SU2, or SU4) is the only contract you would need to purchase IF ordering direct from Cisco or if the reseller is reselling support contracts direct from Cisco.

The CON-SUSA-AS2A20K9 contract covers only signature update support.

All of the CON-SU3-AS2A20K9 (as well as SU1, SU2, SU4, SUO1, SUO2, SUO3, and SUO4) contracts already cover signature support along with software and hardware support.

So if you bought both contracts then you are Double paying for the signature support.

The CON-SUSA-AS2A20K9 is for use Only when the base support contract is being sold by a reseller through a shared support contract with Cisco. That reseller support contract would be purchased from the reseller and not Cisco and the reseller would provide 1st line of support to the customer (while Cisco provided back end support to the resaler).

The reseller contract would cover the software and hardware support while the CON-SUSA-AS2A20K9 would cover the signature update support.

NOTE: The CON-SUSA-AS2A20K9 can Not be purcahsed as the only contract for the sensor. It requires that a correspoding shared support contract be purchased from an authorized reseller.

dicky.sarean1 · ‎02-04-2018

Hi Marc,

Then what is the difference between CON-SUw-ASIPyK9 and CON-SUSA if these two forms are for the signature update only? Are both of them for the same function?

Thanks.

Marvin Rhoads · ‎02-04-2018

The point is moot because the last IPS signature from Cisco will be delivered this April (2018). The product is long past end of sales. April's signature update will mark end of life.