Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

IPS Interface Issues

I recently inherited the maintenance of a couple ASA-SSM-20 platforms on our network. I've never done anything with these before, so please bear with me if I don't know what I'm talking about.

Anyway, they are both supposed to send their events to a CS-MARS machine, but I noticed that only one was generating anything. After logging into the IPS Manager Express, both of the IPS's show up and they both show packets being received and transmitted from both NICs.

So I decided to login via SSH on both of them to compare. NIC1 is supposed to be the sensor interface on both of them, so I tried to see if they were both capturing packets by doing "packet display <interface> count 5". Well, the IPS that is sending events showed 5 packets immediately, while the other one did not.

Also, doing a "show events" on both of them results in a similar occurrence. One displays some events, while the other doesn't.

So I would expect to be able to capture packets if both interfaces show they are receiving and transmitting packets on both machines (the packet count continuously increases). Am I missing something obvious? I've been trying to fix this for a while and I think my brain is frying! Thanks in advance for any suggestions!

1 REPLY
Gold

Re: IPS Interface Issues

Nate -

You can check the ASA config to verify that it is configured to send packets to the AIP-SSM module. Your configs should look similar to these:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliSSM.html#wp1030972

158
Views
0
Helpful
1
Replies
CreatePlease to create content