IPS Versions IPS-K9-7.0-7-E4 & IPS-K9-7.0-8-E4 not working on AIP-SSM-20

mds_cisco_support · ‎06-20-2012

Dear All

I have an ASA 5520 v8.2(5) with AIP-SSM Module on it.

IPS inspection works well in all IPS software version up til IPS-K9-7.0-6-E4.

Whenever I upgrade my module to Version IPS-K9-7.0-7-E4 or IPS-K9-7.0-8-E4, the IPS stop inspecting trafic!!!

I can see clearly that traffic is being redirect properly to the IPS through the following indices:

Increased counters in the ASA IPS class service Policy
Increased counters on the IPS Backplance Interface (IN&OUT)
Proper Traffic classfication on the IPS Dashboard TOP 10 APPLICATION gadget.

But no signature is being fired, and in the IPS Sensor Health, i keep seeing each minute the following activity: "Processing Transaction"

Have anyone faced the same behaviour on these new versions installed on AIP-SSM-20 Modules?

Regards,

Georges

Maykol Rojas · ‎07-10-2012

Georges,

Thanks for the information, have you taken an IP logging on the device to see if the Analysis engine is getting them? What is the status of the MainApp, do you see a failure?

I would like to see this more deep.

Mike