ASA 5510 IPS Module Simple Question

Similar Questions

• IPS in ASA 5510 killing upload speed

  I've recently updated by a circuit of ethernet metro 20 MB for a 100 Mb connection.  My ASA 5510 severely limits the my download speed.  I narrowed down it to the IPS module.  If I stop to send traffic to the IPS, I get speeds of download between 50-85 Mbps.  If I start sending through again, my download speeds are between 3-7 Mbps.  In both cases, my speeds range between 70-92 MB/s, so it's really affecting only my upload speed.  Is there anything I can do for my traffic IPS, so I can still use my modules and still take advantage of the speed upload huge we pay for?

  Here is some info from my ASA:

  I am matching all traffic:

  allow traffic_for_ips to access extensive ip list a whole

  Here is my policy and class parameters:

  class-map inspection_default
  match default-inspection-traffic
  class-map-botnet-DNS
  match eq field udp port
  class-map ips_class_map
  corresponds to the traffic_for_ips access list
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the ftp
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  inspect the preset_dns_map dns
  class ips_class_map
  IPS inline help
  botnet-policy policy-map
  botnet-DNS class
  inspect the snoop-filter-dynamic dns
  !
  global service-policy global_policy
  service-policy botnet-policy to the outside interface

  If anyone has any ideas, I'd love to hear them.  Thank you.

  Created: May 13, 2011 18:49 created by: Chevrel, customer Aastha(AACHAUDH,265429) was experiencing slow download speeds (3-7 Mbps) on in ASA 5510 IPS module. Download the range of speeds between 70-92 MB/s

  Used the workaround for the bug No. CSCsv69844 , i.e. to set the depth of Regex to 800000 (Please note that this workaround should not serve with the recommendation and approval of the ATC.)

• Refuse the TCP (no relation) dan disassembly TCP connection ON ASA 5510, HELP Please

  IM currently implemented with AIP-SSM-10 ASA 5510 IPS and I have problem with ASA, with IPS feature currently disabled, I keep received complain blocked/idle the connection to the oracle server, using port 8000 host remote-office, I traced with syslog and message received from large number associated with the oracle server IP address.

  the network diagram is a bit like this:

  ________ ________ _____________

  | Oracle | switch | ASA 5510 |

  | Server | | ___ |---| transparent |

  -------- -------------

  192.168.10.206 |

  |

  |

  -------------

  | ROUTER |

  |___________|

  |

  ________ -------------

  | DISTANCE | ------ | Router |

  | THE USER | -------------

  ----------

  192.168.5.x

  and the syslog message looks like:

  302013: built inbound connection TCP 1662347 for OUTSIDE:192.168.5.52/1311 (192.168.5.52/1311) inside:192.168.10.206/8000 (192.168.10.206/8000)

  302014: disassembly of the TCP connection 1662345 for OUTSIDE:192.168.5.52/1310 for inside:192.168.10.206/8000 duration 0: 00:00 542 bytes TCP fins

  302013: built inbound connection TCP 1662345 for OUTSIDE:192.168.5.52/1310 (192.168.5.52/1310) inside:192.168.10.206/8000 (192.168.10.206/8000)

  302014: disassembly of the TCP connection 1662343 for OUTSIDE:192.168.5.52/1309 for inside:192.168.10.206/8000 duration 0: 00:00 539 bytes TCP fins

  302013: built inbound connection TCP 1662343 for OUTSIDE:192.168.5.52/1309 (192.168.5.52/1309) inside:192.168.10.206/8000 (192.168.10.206/8000)

  106015: deny TCP 192.168.5.52/1302 to 192.168.10.206/8000 flags ACK END on the OUTSIDE interface (no link)

  302014: disassembly of the TCP connection 1662338 for OUTSIDE:192.168.5.52/1308 for inside:192.168.10.206/8000 duration 0: 00:00 538 bytes TCP fins

  106015: deny TCP 192.168.5.52/1301 to 192.168.10.206/8000 flags ACK END on the OUTSIDE interface (no link)

  106015: deny TCP 192.168.5.52/1298 to 192.168.10.206/8000 flags ACK END on the OUTSIDE interface (no link)

  106015: deny TCP 192.168.5.52/1303 to 192.168.10.206/8000 flags ACK END on the OUTSIDE interface (no link)

  can someone help me, I'm completely stuck on this problem to cause...

  Thank you.

  7.1 (2), which contains the fix for it, is already posted at http://www.cisco.com/cgi-bin/tablebuild.pl/pix.

  If the workaround works for you, however, and you don't touch any other problems, then I would probably recommend you just stay on this version, but I'll leave it up to you.

• AnyConnect VPN license on ASA 5510

  Hello

  We have ASA 5510 IPS with basic license. We must now Anyconnect support for more than 2 users.

  Anyconnect (tunnel mode) but essentially Anyconnect license enough? Do need me a license for SSL VPN peers?

  What about Anyconnect without customer, I see that I need a premium license?

  This one is pretty ASA5510-SSL50-K9? It's really expensive compared the Anyconnect Essentials.

  Here is my worm out sh:

  The devices allowed for this platform:
  The maximum physical Interfaces: unlimited
  VLAN maximum: 50
  Internal hosts: unlimited
  Failover: disabled
  VPN - A: enabled
  VPN-3DES-AES: enabled
  Security contexts: 0
  GTP/GPRS: disabled
  SSL VPN peers: 2
  The VPN peers total: 250
  Sharing license: disabled
  AnyConnect for Mobile: disabled
  AnyConnect Cisco VPN phone: disabled
  AnyConnect Essentials: disabled
  Assessment of Advanced endpoint: disabled
  Proxy sessions for the UC phone: 2
  Total number of Sessions of Proxy UC: 2
  Botnet traffic filter: disabled

  This platform includes a basic license.

  Yes, AnyConnect Premium includes all the SSL features (including the complete tunnel mode AnyConnect - which is what sustains essential AnyConnect).

  So if you buy the 50 user for AnyConnect Premium license, you can have up to 50 SSL VPN connections, if they are the combination of all without customer, or combination of tunnel without customer and full, or just full tunnel. All with a maximum of 50 simultaneous SSL tunnels.

• All Cisco ASA 5510 have the IPS modules

  I am new to the use of Cisco Networking products. I gave me a mission to determine if our company 5510 and 5505 IPS/IDS. In doing my research I discoververed 5505 have no IPS/IDS, but you can buy a card and 5510 have modules IPS/IDS. How can I determine whether my 5510 modue (s) IPS/IDS

  only the new x (but not the 5585) ASAs have software modules. There on the 5505 and 5510 hw modules. But first, you must bring your ASA-access in the order. You can try different browsers, but also make sure that your Java is up to date.

  Sent by Cisco Support technique iPad App

• Licenses, IPS on pair of Cisco ASA 5510 active / standby

  I have two ASA 5510 devices in Active mode / standby.  I think of buying both used IPS modules and their installation.  My question is, me 1 or 2 licenses IPS that requires?  We are on 8.4 right now, and I see 8.3 Cisco changed license to c/o to where you need only one license, not two.  This is true for any way VPN licenses, so I was wondering if the same applies to licenses IPS.

  In addition, the unique licensing model will as much as only requiring a base for the pair a/s license too?  Or is the base license, something that you must have two pair a/s?

  Failover doesn't f, you have only one module in the ASA elementary school. You must have two modules. But it is fine if you do not have a subscription license for your secondary IPS (at least for the system).

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Logging in on a 5525 ASA IPS module

  Hi all

  Quick question here. I have a new ASA 5525 - X with IPS module.

  The PPE must be configured as an ID and told me that without fire view management controller, we can apply a license.

  I have also told me that with the 5525, we cannot install log in module to install the licenses. Please can someone confirm if I can install the licenses for the module? If so, how can I connect to the IDS to implement? Is this possible at all?

  Kind regards

  Riou

  That you listed is the legacy model, which is the end of the sale April 26, 2015. See this notice.

  They have their own Start Guide quick here.

  For these former IPS modules, you do not have licenses. Instead, your Smartnet must be the right kind of contract that includes coverage of subscription for the IPS signature updates.

  Legacy devices management IPS is via ASDM/IDM or, for slightly better visibility, through IPS Manager Express (IME). (There is also the option of Cisco Security Manager for the largest deployments).

  Signature update and software updates for older IPS modules can be done manually or automatically (assuming that you have a valid support contract, which includes the right of the subscription). Instructions for that are here.

• For ASA IPS modules

  Hello

  I would ask you to help learn p/n for the IPS/IDS modules in:

  -ASA 5510

  -ASA 5515 X

  I would like to buy our dealer, but he asks that no part numbers, that he can't find them...

  I know that for ASA5510 was AIP-SSM-10, but it currently is EOS. ASA 5515 X has software module, but I can't find this p/n.

  Concerning

  Hi Michal,

  IPS-ASA5515-SSP

  SSP ASA IPS 5515-X license

  SF-ASAIPS64 - 7.1 - K9

  ASA software IPS 5500-X 7.1 for IPS SSP

  You can always check through "https://apps.cisco.com/Commerce/home".

  It may be useful

  G1

• Recover password of the IPS module (ASA)

  Dear experts,
   
  I have an ASA 5500 series with AIP SSM (IPS module), the username and password are lost.
   
  According to cisco portal, there are two approaches to recover the password:
  1 using the CLI command: hw-module module reset slot_number password;
  2. with the help of ASDM--> tools--> 'IPS password reset.
   
  Not sure whether the two commands to achieve the same result (retrieve password) or they may have different results (i.e. need to reset the module).
   
  The device is online, reset module is not privileged.
   
  After checking the information from the internet, it offers to reset the IPS module. Any problem will be produced if the IPS module is not reset?

  RDG
   
  Anita

  Hi Anita,.

  You can try using:

  HW-module module slot_number password reset

  Who will reset just the IPS to its default username/password:

  Cisco and cisco

  You can access the ASA CLI IPS:

  session 1

  Then type cisco and cisco (username/password)

  For example, you could add a new password.

  Don't forget to evaluate and select the right answer.

• Is a CSC module must use Smartfilter with an ASA 5510?

  We use a PIX 515E and an external Smartfilter server for URL filtering for many years. Works well, but we want to add the IDS feature. The road ahead for this seems to be to get an ASA 5510 with AIP module. Can anyone confirm if we continue to use the order of FILTER of URL (with Smartfilter specified as a salesman and pointed to the IP address of the server Smarfilter) as we do on the PIX? Sales of Cisco tells me that I need a module of CCS for it which means I can't have a module AIP, but the way I read it which seems to be only if you use URL of the CSC (user account subscription) database to perform the filtering. We do not want. We left 3 years on our contract of Smartfilter. I just talked to someone who has an ASA 5510 without a CSC module and it was successfully entered a FILTER of URL command in his ASA, as you would on a PIX. Why wouldn't work?

  for the URL filtering, NO, you need not any type of license, this isn't a feature defined licensed, its rather a feature of configuration

• Updated AIP-SSM-10 on ASA 5510

  Hello

  I want to upgrade the IPS module in an ASA 5510, and I have a few questions. The AIP - SSM is running E3 479.0 1.0000 and I have a valid account of the ORC etc for this.

  1. What is the version of the software on the question of the ASA?
  2. When I look in the software downloads< ips="" there="" are="" .pkg="" and="" .img="" files.="" i="" want="" to="" upgrade="" to="" 6.3(3)e4.="" do="" i="" have="" to="" re-image="" the="" ips="">
  3. AFAIK redefinition to wipe the device so I just reload the config after, right?
  4. I guess I can apply any update after going to E4?
  5. Can you give me links for this upgrade?

  see you soon

  Let me give some clarification on a few points:

  2. There is no need to recreate the image on the device using the .img file.  You can improve the mechanism of maintenance of your existing configuration using the .pkg file.  It is the recommended method for upgrading to Cisco IPS devices/modules.  The .img file to recreate the image should only be used to restore the default device.

  5 here are links for the upgrade of the probe using a .pkg file.  For updates through the IDM user interface:

  http://www.Cisco.com/en/us/docs/security/IPS/6.2/configuration/guide/IDM/idm_sensor_management.html#wp2126670

  For upgrades via the CLI:

  http://www.Cisco.com/en/us/docs/security/IPS/6.2/configuration/guide/CLI/cli_system_images.html#wp1142504

  Another point of clarification; current releases of IPS software supported on the AIP-SSM-10 are (taking into account you are currently running 6.2 (1) E3):

  6.2 (3) E4

  7.0 (4) E4

  You can go directly to each output.

  Scott

• Cisco ASA 5510 + license + AIP - SSM

  Hello.

  I have this box.

  I have a few questions about it.

  (1) I'll be able to update the firmware (from 8.2 to 8.3 or greater for example) without smarnet for ASA 5510? And what can not do without smartnet?

  (2) I have only AIP-SSM-10 module this ASA 5510. is there a smartnet, too? And when I buy only one module is it build in a subscription for 1 year for the signatures of the IPS?

  (3) if I have the Cisco ASA 5510 base license, my IPS on AIP-SSM-10 will work?

  (4) as I foresee in a purchase of the year a 5510 more with the same module and mount ther of failover. I really need license Security more than failover (active / standby)? For active/active, I know I need one, Yes?

  Please help me.

  (1) you must Smartnet in order to download the software from the download from cisco.com site.

  (2) Yes, there is also a smartnet for the AIP module. Module AIP does not come with one year subscription, but you can ask for a demo license.

  (3) Yes, the basic license is OK for the AIP module.

  (4) Yes, you would need license security more on the two ASA to be able to run any type of failover on ASA5510.

  Hope that answers your questions.

• ASA 5510 replacement and ARP

  Hello support,

  Probably a simple question and can be buried in these forums (but I'm not).

  I am trying to replace one 5510 with another 5510 and have all kinds of difficulties.  Devices the PAT against the external interface have no problem out, but anything with a 1:1 NAT cannot.  Cries of an ARP issue; However, to restart the switch and firewall are without effect.  Is there something else I could potentially be missing.  Configurations are completely reversed.  And the firewall, that the I'm replacing has no problem going out with NAT (static) 1-to-1.  Any ideas?

  Hello

  I assume you mean a L3 switch that you begin with the ASA?

  If this isn't the case, then where is the gateway of your ASA L3 and who manages this device?

  One thing that comes to mind associated with ARP is that if you use several public subnets on your ASA. For example 30 for network connection between your site and the ISP and some 28 as a public subnet for purposes of NAT static. Then you may experience problems IF your software has changed to 8.4 (3) or something higher.

  If ARP is the problem then it is of course the option that makes you check the original interfaces of ASAs (connected to the ISP) MAC address and configure this same MAC address to the new WAN ASAs interface to the ISP.

  You can actually go under the interface and deliver MAC address with the command

  0000.1111.2222 Mac address

  In addition, naturally when it comes to configurations and firewall rules you can always use the command "packet - trace" to simulate the packets from your local network for the EXTENDED or WAN network to the local network and see the race passes through completely.

  -Jouni

• IPS module does not

  Hi, I'm currently running active / standby and my sometimes (twice a year) IPS module goes on which triggering a failover. The current status is:

  This host: secondary: enabled

  Another host: primary - failed

  and on the primary host-: slot 1: ASA-SSM-10 rev hw/sw (status 1.0/6.1(1)E3) (does not/high)

  I know that I have to go in the module and hw-module module reset. But I opened a file and got a replacement Module ID. Do I need to power down my ASA primary, it is in mode of failover in any case... If I turn off, it would result in any question of production since I am currently on secondary. Also, I read that the module will not keep or config between synchronization devices. How can I access the configuration of the IPS module so that I can put it in the new module?

  Thanks for the reply.

  FYI, these issues must be addressed with the CSE assigned to your request for Service of TAC where RAM was arranged. I'll take a shot at answering them, but when you use a query from Active Service of the TAC, you must act together with the CSE assigned to issues related to the issue.

  Do I need to power down my primary ASA

  Yes, sensor AIP - SSM modules are not able to SEE (Insertion/withdrawal online). ASA in which the sensor module is replaced must be powered down before removing the faulty sensor module and before installing the replacement.

  if I do power down, would it cause any issue to production since I am on secondary right now.

  If the other Member of the ASA of the failover pair is currently active and its sensor module is in Place, then power the unit standby off ASA should not affect traffic.

  I have read that the module won't retain or synch config between devices. how do i access the configuration of the IPS module so that I can put it into the new module?

  Correct, the sensor modules do inheritly not synchronize or replicate their configuration (such as units of the ASA of the failover pair). If you are able to access the defective sensor module long enough to get a copy of the "show config" command, you can integrate this same output in the replacement sensor module.

  Finally, note that the Unresponsive State can be caused by hardware problems. IPS 1.0000 E3 (which is what you seem to be running) is very old and is more directly supported. You need to upgrade to a modern version, supported (E4 7.0 (6) or 6.2 (4) E4), which contain a lot of bugs, which some correct problems that might otherwise cause the module become Unresponsive.

• ASA 5510 Firewall ACLs HITCOUNT

  I have a simple question, but I'm having a hard time getting a response. When you show command access-list on the ASA 5510 there are a number of access... .i know clearly but I want to knowis it a default timer which will clearly be the number of accesses? Or the number of access remains until I have clear the County? I'm trying to clean up ACLs and for future troubleshooting I would like to know that. I don't want to remove an ACL entry with hitcount 0 and then it is necessary.

  The counters are there until one of two things will happen; you delete them manually or you restart the device. There is no timers to clear the counters. Usually, clear us the counters, let it run for a month or so to clean it up.

  Hope that helps.