Cisco ASA questions

[nitass]

Hi everybody,

I’ve a few questions about ASA with AIP-SSM. Could you please clarify me?

1. Is the management interface of AIP-SSM necessary? Can I use IPS feature without it?

2. Can I use ASA as an IDS box? I mean just for sniffing traffic only. How can I connect it to network?

Please advice.

Thanks,

Nitass

[attrgautam]

1) AFAIK the mgmt interface is jus for that. Management only. IPS can very well work without that as the traffic to the IPS will be switched on the backplane.

2) The AIP-SSM can be used as an IDS. The ASA will have to pass traffic inline and redirect the traffic to the AIP-SSM in promiscuous mode.

[nitass]

Thanks for your reply.

Regarding to use AIP-SSM as IDS, I don’t want to place it in the path of traffic. I’d like to configure SPAN port or something like that on switch and connect it to the AIP-SSM. Can I do that? What’s interface that it should be used? Mgmt of AIP-SSM? ASA’s Ethernet interfaces?

Please advice.

Thanks a lot,

Nitass

[attrgautam]

Doubt if you can use the AIP-SSM sitting in an ASA in such a scenario. The typical scenario is to put the ASA inline and push all the traffic to the SSM through the backplane using 'Span' (actually sending a copy through the backplane). The Mgmt interfaces are used for only mgmt.

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df98.html

This link will explain how to install AIP-SSM in promiscuous mode.

[nitass]

Really I just want to know if the ASA can replace the existing IDS device in the network. Because I’ve gotten the notification email about the IPS device will be replaced with the ASA with AIP-SSM.

Any suggestion please let me know.

Thanks a lot,

Nitass

[jackko]

i guess they offer similar features if not identical. performance on ssm is better than the basic model of 42xx.

one matter is that 42xx has more than one interface, and thus it can sniff multiple network segment at the same time; whereas ssm has only one monitor interface.

[nitass]

Do you mean ASA with AIP-SSM can sniff traffic as IPS? I mean only one connection attach to the network.

Thanks a lot,

Nitass

[attrgautam]

If you are asking if the SSM can act as an IPS blocking attacks inline, the answer is yes. The AIP-SSM can act as either IPS or IDS