Unable to Login into IPS (AIP-SSM-10)

Unanswered Question
Apr 2nd, 2009


I have AIP-SSM-10 module which is plugged into cisco ASA.The issue which I am facing is when executing the command hw-module module 1 details output from cisco ASA console I see the status of IPS has gone into unresponsive.

The output is shown as below:

ciscoasa# sh module 1 details

Getting details from the Service Module, please wait...

Unable to read details from slot 1

ASA 5500 Series Security Services Module-10

Model: ASA-SSM-10

Software version:

Data plane Status: Not Applicable

Status: Unresponsive

Becoz of this I am not able to login into IPS neither I can reimage it.

Is there any solution for this?

Can anyone help me out in this...?



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
michael.d.brown... Thu, 04/02/2009 - 08:35

if you have tried a shutdown of the module, reset and recover and a complete power down of the ASA, then you will need to have the module replaced. I have 96 AIP-SSM modules and have ran into this very often especially on the old 6.0.x software, but not so much on the 6.1.x versions.

marchanamendon Mon, 04/06/2009 - 01:00

I have tried shutdown ASA,then performed reset also,but IPS goes first to Init status then immediately goes to unresponsive state.Since it does not show me IP address I am not able to login into the IPS also.

can you help on this?

UCcomp2007 Mon, 04/06/2009 - 03:38

I think your only option now is to re-image the module. I had the same problems as you on Saturday and had to re-image. Below is example pulled from IPS Config Guide

If you have to go this route, download image from CCO and get TFTP server running.


Step 1 Log in to the ASA.

Step 2 Enter enable mode:

asa> enable

Step 3 Configure the recovery settings for AIP-SSM:

asa# hw-module module 1 recover configure


Step 4 Specify the TFTP URL for the system image:

Image URL [tftp://]:


Image URL [tftp://]: tftp://

Step 5 Specify the command and control interface of AIP-SSM:

Port IP Address []:


Port IP Address []:

Step 6 Leave the VLAN ID at 0.

VLAN ID [0]:

Step 7 Specify the default gateway of the AIP-SSM:

Gateway IP Address []:


Gateway IP Address []:

Step 8 Execute the recovery:

asa# hw-module module 1 recover boot

Step 9 Periodically check the recovery until it is complete:

marchanamendon Mon, 04/06/2009 - 03:53


We can try this method if the IPS displays me the management IP address in the sh module 1 details command.

But in my AIP-SSM since it has gone to unresponsive state,even the management IP I am not able to ping.So I am not able to do anything.

As shown in earlier message the output of AIP-SSM when it shows unresponsive state.

UCcomp2007 Mon, 04/06/2009 - 05:25

HI marchanamendon

You are able to do this as part of the image recover process is setting the management IP (which is listed as port ip in guide). This worked for me when my SSM-AIP had not manageemnt IP and was in the unresponsive state. Please look to below guide for direction and example.



marchanamendon Mon, 04/06/2009 - 21:47


I have one query,it will be grateful if u can help.Since this is the first time I am facing this trouble.

I have connected laptop directly to the management port of AIP-SSM.The IP configured on laptop is

From Cisco ASA,I performed first this command hw-module module 1 reset.

After this I rebooted the ASA.

Now when executing the command,

hw-module module 1 recover configure,it runs through the series of commands..

Here I configure

Image URL [tftp://]: tftp://

Port IP Address []:

Gateway IP Address []:

Can you let me know what should I configure the port IP address and the gateway IP address?



marcabal Tue, 04/07/2009 - 06:05

The port IP Address is the IP address you need to assign to your SSM in order for it to connect to your laptop.

Since your laptop has an IP address of, then your SSM needs an IP Address within this same subnet. I would suggest using either or

Since both your SSM and your laptop are on the same subnet and directly connected, then a gateway is not necessary. Traffic from your SSM can go straight to your laptop without needing to be routed. So the Gateway IP can stay at


This Discussion