Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Using ASA5510 AIP-SSM in IDS mode

Hi,

I' ve a Cisco ASA5510 with  AIP-SSM and I wold like to use it like a one-armed IDS for connect them to a span port of a switch in my network,

without the traffic passing through the Firewall.

I've try to configure it and connect the interface inside (fast0/1) to the span port, I create the policy for permit  all the traffic to the  Sensor but it doesn't work, no packet recived on sensor.

somebody can help me?

thanks

2 REPLIES

Re: Using ASA5510 AIP-SSM in IDS mode

Hi,

When you have the AIP-SSM card on the ASA, you can configure it to operate in promiscuous (IDS) or in-line (IPS) mode.

To be able to use any more, traffic should flow through the ASA.

The difference is that when operating in IDS mode, only a copy of the packet is sent to the card.

When operating in IPS mode, the traffic is sent through the card, allowing the IPS module to be in the path of the traffic.

Please check the information:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ips.html

Federico.

Gold

Re: Using ASA5510 AIP-SSM in IDS mode

Unfortunately you can't use the AIP-SSM in an ASA with a spanning switch like you could with the 4200 series appliances.

The reason is that the ASA was built to be a firewall, and no matter how much of that functionality you turn off, it still needs to see TCP and UDP conversations flowing thru the ASA in order to pass that traffic to the AIP-SSM sensor (I tired very hard to see if I could get around this limitation, but you can't).

The best you can hope to do is put the ASA in-line (I know this reduces reliability) and turn off as much of the firewall configs you can. Then you can promisciously monitor the traffic passing thru teh ASA with teh AIP-SSM.

It's not ideal, but it's the cheapest IPS sensor in Cisco's line up right now.

- Bob

1381
Views
0
Helpful
2
Replies
CreatePlease to create content