Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

AIP-SSM configuration / blocking SMTP

Hi all,

I need some help regarding a deployment of a IPS module on a ASA. I configured it in transparent mode, with the intention to only monitor the traffic going through the module. Otherwise after aplying the policy and put it in operation, it started blocking SMTP and ICMP traffic. Here follows the configuration applied to it:

class-map outside-class

match any

policy-map outside-policy

class outside-class

ips promiscuous fail-open


service-policy outside-policy interface outside

Is there anything else I should consider to put this module just monitoring the traffic instead of having it denying any traffic?

Thanks in Advance

Cisco Employee

Re: AIP-SSM configuration / blocking SMTP

You may need to create an access-list permitting all traffic, and then apply the access-list to both interfaces in both directions (in and out).

This will ensure connections can go from the lower security zone to the higher as well as from the higher security zone to the lower.

You may also need to add icmp permit lines to permit icmp traffic through each interface.

New Member

Re: AIP-SSM configuration / blocking SMTP

Thanks Marcabal for your reply. I'll proceed with the changes and let you know about the results.

CreatePlease login to create content