Our AIP-SSM-20 module no longer seems to be processing any traffic from our ASA5540.
I have it set-up to log to our CSMARS system. A few days ago, I noticed the CSMARS was showing âinactive CSMARS reporting deviceâ and when I checked the IPS events from the module using IME there were no events at all - not even low or informational.
Similarly, if I use show stat virtual-sensor vs0 on the IPS module the number of packets processed is no longer incrementing.
When I checked when I last received an event successfully, it coincided with when the IPS had auto-updated with signature S406. It has since also auto-updated with S407. Apart from this, nothing has changed config-wise on either the IPS module or the ASA itself so I cannot understand why the traffic no longer seems to be getting processed.
Any suggestions on what the problem could be? Is it possible something has gone wrong with the auto signature update and, if so, is there any way I can remove the last 2 signature updates to see if traffic is processed again?
Any advice would be welcome!