AIP - SSM in cluster


We have a failover cluster ASA, with 2 IPS, each in an ASA AIP - SSM. There is a way of module config mode cluster as ASA IPS, or have a configuration that is mirrored between them?

Thank you very much.
Better with respect to Antonello.



Configuration mirroring between the AIP-SSMs is not currently available.  You can emulate this process by copying the current configuration of the AIP - SSM active to a FTP server, change the configuration to remove the specific details of the host (IP address, etc) and then copy this configuration on the stand by AIP - SSM.

Another option would be to invest in Cisco Security Manager (CSM) and create a shared strategy that is applied to the two AIP - SSM.


Tags: Cisco Security

Similar Questions

  • Updated AIP-SSM-10 on ASA 5510


    I want to upgrade the IPS module in an ASA 5510, and I have a few questions. The AIP - SSM is running E3 479.0 1.0000 and I have a valid account of the ORC etc for this.

    1. What is the version of the software on the question of the ASA?
    2. When I look in the software downloads< ips="" there="" are="" .pkg="" and="" .img="" files.="" i="" want="" to="" upgrade="" to="" 6.3(3)e4.="" do="" i="" have="" to="" re-image="" the="" ips="">
    3. AFAIK redefinition to wipe the device so I just reload the config after, right?
    4. I guess I can apply any update after going to E4?
    5. Can you give me links for this upgrade?

    see you soon

    Let me give some clarification on a few points:

    2. There is no need to recreate the image on the device using the .img file.  You can improve the mechanism of maintenance of your existing configuration using the .pkg file.  It is the recommended method for upgrading to Cisco IPS devices/modules.  The .img file to recreate the image should only be used to restore the default device.

    5 here are links for the upgrade of the probe using a .pkg file.  For updates through the IDM user interface:

    For upgrades via the CLI:

    Another point of clarification; current releases of IPS software supported on the AIP-SSM-10 are (taking into account you are currently running 6.2 (1) E3):

    6.2 (3) E4

    7.0 (4) E4

    You can go directly to each output.


  • AIP - SSM 40-level question.


    I am trying to upgrade the AIP - SSM software file 'IPS - K9 - 6.0 - 6 - E4' in 'IPS-engine-E4-req-7.0-2 '. But it is not allow.

    "Could not pass the software on the sensor.

    Level the current signature is S698. The current level of the signature must be less than S480 for this installation package. »

    So I tried to update the signature file less than S480, "IPS-GIS-S460-req-E3".

    "Can not upgrade the sensor software be"
    This update can be installed on the sensor with and the version of the 3 engine.

    The currently installed engine version is 4.

    There is no signature file in cisco downloads less S480 in version 4 engine.

    See the version

    AIP - SSM # sho version

    Application partition:

    Cisco Intrusion Prevention System, Version 6,0000 E4


    Domain keys key1.0

    Definition of signature:

    Update of the signature S698.0 2013-02-19

    OS version: 2.4.30 - IDS-smp-bigphys

    Platform: ASA-SSM-40

    Serial number:

    License expires: November 3, 2013 UTC

    Sensor time is 3 days.

    Using 4203216896 bytes of available memory (24% of use) 1045143552

    application data using 41.4 M off 167.8 M bytes of disk space available (26% of use)

    startup is using 37.8 M off 70.5 M bytes of disk space available (57% of use)

    MainApp N-NUBRA_2009_JUL_15_01_10_6_0_5_57 (Ipsbuild) 2009-07 - 15 T 01: 15:08 - 0500 Running

    AnalysisEngine NO-NUBRA_E4_2010_MAR_24_22_44_6_0_6 (Ipsbuild) 2010-03 - 24 T 22: 47:53 - 0500 Running

    CLI N-NUBRA_2009_JUL_15_01_10_6_0_5_57 (Ipsbuild) 2009-07 - 15 T 01: 15:08 - 0500

    Upgrade history:

    * IPS - K9 - 6.0 - 6 - E4 21:14:06 UTC Wednesday, March 24, 2010

    IPS-GIS-S698-req - E4.pkg 15:44:43 UTC Sunday, February 24, 2013

    Version 1.1 - 6, 0000 E4 recovery partition


    Any help will be much appreciated... Thanks in advance.


    If you try the software version Upgrade, try to use the IPS-K9-7, 0-2 - E4.pkg instead of the engine update package.

  • Cisco ASA 5510 + license + AIP - SSM


    I have this box.

    I have a few questions about it.

    (1) I'll be able to update the firmware (from 8.2 to 8.3 or greater for example) without smarnet for ASA 5510? And what can not do without smartnet?

    (2) I have only AIP-SSM-10 module this ASA 5510. is there a smartnet, too? And when I buy only one module is it build in a subscription for 1 year for the signatures of the IPS?

    (3) if I have the Cisco ASA 5510 base license, my IPS on AIP-SSM-10 will work?

    (4) as I foresee in a purchase of the year a 5510 more with the same module and mount ther of failover. I really need license Security more than failover (active / standby)? For active/active, I know I need one, Yes?

    Please help me.

    (1) you must Smartnet in order to download the software from the download from site.

    (2) Yes, there is also a smartnet for the AIP module. Module AIP does not come with one year subscription, but you can ask for a demo license.

    (3) Yes, the basic license is OK for the AIP module.

    (4) Yes, you would need license security more on the two ASA to be able to run any type of failover on ASA5510.

    Hope that answers your questions.

  • Getting started: ASA5520 w / AIP - SSM

    I'm trying to deploy an ASA5520 to a customer. I have no problem with the piece of implementing firewall, but I don't know where to start with the piece of IPS.

    I searched a bit on the ASA55XX & AIP - SSM, but can't seem to find much on what to do with the AIP - SSM beyond the initial Setup.

    Can someone point me to some beginners IPS documentation that focuses on the AIP - SSM?

    Thank you


    In my view, there is a lack of documentation on how to get the IPS module to work with the ASA. It would be nice if there was a single document on how to get IPS working module with the ASA.

    Start with the documentation of the IPS. It's just on how to configure the IPS himself module. Assign an IP address for management, set the admin password, etc..

    Then go to the documentation of the SAA on how to configure ASA to send traffic to IP addresses (via a service-policy):

    There is a free viewer of IPS Cisco event offering to monitor events on the IPS. It can be downloaded from the download page of the Cisco IPS software.

    Finally, read the whitepaper SAFE on the deployment of the IPS and the setting.

    I hope this helps. Remember messages useful rate. Thank you!

  • Help configuration AIP - SSM

    I have two questions about the AIP - SSM.

    (1) is the ACL in AIP - SSM has any type of relations to the ASA ACL?

    2) our four interfaces are all used. Is it possible to assign the SSM an IP address in the same subnet as the management interface?

    (3) should then the management interface serve as a gateway for the SSM?

    interface GigabitEthernet0/0

    nameif outside

    security-level 0

    IP address 65.x.x.1 watch 65.x.x.2


    interface GigabitEthernet0/1

    nameif dmz

    security-level 50

    IP address 172.16.x.1 watch 172.16.x.2


    interface GigabitEthernet0/2

    nameif inside

    security-level 100

    IP address 192.168.x.1 watch 192.168.x.2


    interface GigabitEthernet0/3

    STATE/LAN failover Interface Description


    interface Management0/0

    Speed 100

    full duplex

    nameif management

    security-level 100

    IP address 10.0.x.1 watch 10.0.x.2

    management only

    Here are the answers to your questions-

    (1) is the ACL in AIP - SSM has any type of relations to the ASA ACL?

    No of years) ACL on SSM is completely independent of the ACLs on the ASA.

    2) our four interfaces are all used. Is it possible to assign the SSM an IP address in the same subnet as the management interface?

    VNA) absolutely. You can assign the SSM management port IP address in the same subnet as your managemnet interface. In this way, all management traffic will remain independent of normal DATA traffic.

    (3) should then the management interface serve as a gateway for the SSM?

    VNA) you're right... :-)

    Hope that helps.

    Kind regards


  • Reloading of the AIP - SSM

    reload the module AIP - SSM affect the ASA?

    Exactly. If you don't have a political card by using the SSM module, then you can reload the module SSM and it does not affect the traffic passing by ASA. To give you more information, here is a link that gives you information on how to configure ASA to use the SSM module:

    Hope that helps.

    Kind regards


  • NTP Windows Server and AIP - SSM

    We use a server based on Windows as the NTP server. But I need the NTP key to configure NTP on the AIP - SSM, key to the ID value and the NTP. How do you find this information or bypass? Or is it possible to set the clock without using an NTP server. I disabled the NTP service, hoping that it will use the firewall clock, but it didn't.

    Kind regards

    Your offset must be-360.

    The offset is in minutes rather than hours. Now, you say that the CDT is only 6 MINUTES from GMT when what you want-6 HOURS-360 minutes.

    offset - 360

  • AIP - SSM maintenance of Configuration in Active mode Stdby

    So, I'm pretty new to the AIP - SSM but not for the ASA. It seems that very few of the AIP module configuration gets copied to the AIP Stdby, nothing else that what appears in the config of the ASA (ACL, etc.). Thus, all elements of specific configuration for the module itself must be manually reproduced on Stdby module, either entered hand or config copies moved between the two?

    Planned in the future.

  • AIP - SSM 10 Signature Update license?

    Hi every one.we had an AIP - SSM 10 for our asa5520.actually it is bundle asa5520 + AIP-SSM10. (part number ASA5520-AIP10-K9 =)

    (1) I want to know that if we want to improve our signature aip - ssm we get the Services Cisco IPS download signatures or not with this number of pürt we get it too!

    (2) in the case and we must get the Cisco IPS services separately so where can I find a reference number for the services of this?

    (3) what license that must be installed on the sensor activation? If we get the Cisco Services for FPS then we receive license activation for installation on sensor too? or not if not, can we install signatures on a sensor that it has not been activated yet? guess we can get a few signatures how! (I know JOINT-2 we cannot install any license until the license is installed on the sensor.) Thank you

    CON-SU1-AS2A10K9 would be the correct contract to put all the pieces of the boot under the maintenance contract.

    CON-SU1-ASIP10K9, this is what is used when the AIP-SSM-10 are purchased as spare.

    I don't know if yes or no this Service Cisco IPS contract can be used to cover only the AIP-SSM-10 if it was purchased as part of a package instead of a spare part. You will need to ask your reseller or Cisco sales representative.

  • AIP-SSM-10 and syslog

    I ASA5520 with AIP-SSM-10, and I want to send messages from IPS sensor to the external syslog server. I'm not able to find, how to configure it.

    Thank you for any suspicion.

    From now on, SSM modules cannot be configured to send events as syslogs to a syslog server. You can send these events to the spectators of the event or security monitor.

    Kind regards


  • Automatic update AIP-SSM-10 and ASA 5510 (Beginner)

    I see that it is possible to automate the updates of the ASA 5510 and AIP SSM via FTP on my own server. Is it possible to automate the download directly from

    Thank you!


    Jeremy, the answer to your question is correct, as far as the Cisco products are concerned. So I wrote a PERL app that does exactly that, and I published an article about it in the June 2007 issue of Sys Admin magazine. Here's the article online:

    And it is also on my site, with a tar of scripts to:

    Good luck.


  • Cannot access the AIP SSM via ASDM

    CISCO recommendations below:

    Cannot access the AIP SSM via ASDM


    This error message appears on the GUI.

    Error connecting to sensor. Error Loading Sensor error


    Make sure that the IPS SSM management interface is up/down and check his IP address configured, default gateway and the subnet mask. It is the interface to access the software from Cisco Adaptive Security Device Manager (ASDM) on the local computer. Try to ping the address of management of IPS SSM IP interface on the local computer that you want to access the ASDM. If it is impossible to do a ping check the ACLs on the sensor


    I've tried everything recommended above. I can ping the host ASDM the FW and the SSM-10 module. Well, I ping the host machine and the SSM of the ASDM. I opened as wide as possible ACL. I changed the IP addresses and masks several times. The management of the ASA port and the SSM and the PC are on the same subnet.

    A trace of package from the PC to the SSM shows that it is blocked by an ACL rule, and yet I opened wide.   I've seen this kind of problem before and it was solved by applying the double static NAT, but I don't know how to do that if all the IP addresses are on the same subnet.

    Tried everything, need help from high level.

    The IDM software that comes with ASDM does not support java 1.7. The portion of the ASDM ASA supports 1.7 but launch the IPS cmdlet works only with 1.6. The TAC enginner suggested that I use the IME (IPS Manager Express) which is available for free on the Cisco's ( Web site.

    I've been playing with it today, and so far it seems to work pretty well.

  • (ASA) AIP - SSM 10 Inline; Supreme events?

    A 5520 ASA with SSM-10 GOAL is set to inline mode, but the events of the show for 2 hours (sensor > HS event past 02:00) of the Interior of the sensor shows and "promicuous mode", "left promicuous mode'."

    This AIP SSM - 10 has only one gig0/0 and gig0/1 where o/o is taken out of service and a value default virtual sensor (vs0) is assigned to gig0/1. I see the statistics (sensor > sh SEO-engine of analysis) to gig0/1 so I collect statistics.

    If the configuration of the ASA 5520 has the following policy of inline and events log shows that enter and exit in promiscuous mode so how do I check if I am inspection/recovery in inline mode?

    (ASA > sh run access-list IPS)

    IPS list extended access permitted ip DMZ

    (ASA > sh run | b class-map)

    class-map IPS

    corresponds to the IP access list

    class-map inspection_default

    match default-inspection-traffic



    type of policy-card inspect dns preset_dns_map


    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the netbios

    inspect the rsh

    inspect the rtsp

    inspect the skinny

    inspect esmtp

    inspect sqlnet

    inspect sunrpc

    inspect the tftp

    inspect the sip

    inspect xdmcp

    inspect the waas

    inspect the icmp

    class IPS

    IPS inline help


    global service-policy global_policy

    (sensor > sh interfaces)


    Statistics interface GigabitEthernet0/1 MAC

    Function of interface = interface detection

    Description =

    Support type = backplane

    By default Vlan = 0

    Inline = unpaired mode

    Pair of status = n/a

    Circumvention of Capable hardware = no.

    Twin derivation material = n/a

    Link status = upwards

    Link speed = Auto_1000

    Link Duplex = Auto_Full

    Lack of Packet percentage = 0

    Total packets received = 95044

    Total number of bytes received = 8715230

    Total multicast packets received = 0

    Total of broadcast packets received = 0

    Total fat packets received = 0

    Total sousdimensionnés packets received = 0

    Receive the total errors = 0

    Receive FIFO overruns total = 0

    Total packets transmitted = 95044

    Total number of bytes sent = 9047702

    Total multicast packets sent = 0

    Total broadcast packets sent = 0

    Total fat transmitted packets = 0

    Total packets transmitted sousdimensionnés = 0

    Total transmit errors = 0

    Total transmit FIFO overruns = 0

    sensor > sh events last 02:00

    evStatus: eventId = 1203360411830836145 = Cisco vendor


    login host: ASA2_IPS

    appName: kernel


    time: 2008-02-20 19:01:46 2008/02/20 19:01:46 UTC


    Description: device ge0_1 entered promiscuous mode

    evStatus: eventId = 1203360411830836146 = Cisco vendor


    login host: ASA2_IPS

    appName: kernel


    time: 2008-02-20 19:01:53 2008/02/20 19:01:53 UTC


    Description: the promiscuous mode device ge0_1 left

    The left State events and entered promiscuous mode are usually generated when you do a 'package of display' or 'the capture of packets' command on the CLI of the sensor.

    Track order of the package is promiscuity but is independent of promiscuity or inline followed by analysis of the probe engine.

    If you have inline monitoring using the probe analysis engine.

    And still make command package to the cli for your own monitoring promiscuity of those same packets. Here are 2 independent monitors of the same packages.

    If I remember right inline monitored packets always get returned to the ASA (unless expressly denied), which is not promiscuous packets. So check sensors gig0/1 interface statistics and the number of packets for transmission. If receive and transmit accounts are quite close, then packets are monitored by the analytical engine InLine. If the number of transmission is nil or very low then the packets are likely promiscuous monitored.

    With the configuration of your ASA you are correctly configured for online tracking.

    So I don't think that you are investigating inline, and status messages are specific to your start and stop of the command 'package' on the CLI for your own independent viewing packages promiscuity.

  • AIP - SSM


    Scenario of

    2 networks

    outside the network ALL

    inside the network

    How can I simulate the work of AIP - SSM at the back of the firewall?

    My version.

    test access extended list permits all ip

    the class map test

    match name of group-access test

    the policy-map test

    the class test

    IPS inline help

    Expected that all comments

    Thank you


    My expertise lies in the IPS and not the firewall. My knowledge of the firewall is quite limited in what it takes to get the packages to the SSM.

    SO I'm not sure what the ACL are applied before the decryption or after decryption.

    If you want to know at what stage the ACL are applied, you need post a message on the forum of firewall.

    I was just trying to show that all firewall features (whatever they are) would be on the package before sending it to the SSM with the exception of encryption and the final drive.

Maybe you are looking for

  • dv9700 raid

  • Equium A60 - 199: ITunes and Mat * a UJ - 830 s (error 4280)

    I can't burn CDs on my laptop. This has never before been a problem, but recently, no matter what type of burning software I use, I can't burn it to a cd. I am currently using ITunes version 6 and after the burning process starts my computer ejects t

  • WC760AA-B1Q: monitor

    Hello and Merry Christmas I have the HP Touchsmart 600PC-1160 gr and I was told by a technician that my monitor does not work.  He tried to change the graphics card but nothing.  So he advises me that I have to change monitor or repair the inside of

  • My computer does not recognize my dvd players or cd, how can I fix?

    I recently installed a new hard drive, video card, and the new monitor.  Everything seemed to work very well; has been able to see and use the readers; update of all; now a few days later my PC does not show that I have a Dvd or Cd installed.  Shows

  • Pix515 problem

    in the following rule: static (dmz, outside) interface PORT # server port # netmask tcp 0 0 Is it possible to state several # s to a port PORT #? If so, how? Thank you non-eclairees