ASA-SSM-10 inspection load 100% (version 7.0 (5 a) E4)
Hi all
I have a challenge with the IPS module in ASA5520, ASA-SSM-10. When we start a try to connect to Web servers, I get a load of 100% inspection and will slow down the traffic/performance.
We test with 63000 sessions per minute making a load of: the test-servers (clients) on the web servers of 20,000 Kbps and traffic from servers web-back to the test-servers (clients) 75.000 kbits/sec.
Can you please advise what to do because we cannot live with this environment only when this is fixed.
Thanks in advance,
Erik Verkerk.
We have not used charge of inspection in order to determine the appropriate sensor performance, instead, we have relied on "percentage of failed package" reported by the sensor. When the sensor gets into trouble, that they will begin to run out of packets for inspection, this causes the sensor wrong determination of the TCP State for some of the connections. This causes the sensor to use more resources than necessary to inspect traffic, leading to lack more packages.
It is its called the "death spiral" and we try to avoid it as much as possible.
Cisco has a long and proud history of providing performance numbers 'blue sky' for their products. We used to refresh their numbers of performance of the IPS sensor by half, but they made improvements over the years and now we take only about 1/3 wide of reported values. You can see for yourself with real, live production traffic.
I'm havn; t found the number of signatures in a meaningful way sensor effect performance unless you touch abnormally difficult or lit a large number or tuned to perform many actions per second.
-Bob
Tags: Cisco Security
Similar Questions
-
Percentage of the processing load = 100
Hello
The guys I worked with 3 IPS 4260 2 and a 4270 yesterday, I noticed that the Inspection is RED. On the 4260 is the responsibility of the inspection.
SJDetec1 # sh - virtual statistical sensor | Load Inc.
Percentage of the processing load = 99
On the 4270!DCDetect1 # sh - virtual statistical sensor | Load Inc.Percentage of the processing load = 100DCDetect1 engine # sh - statistical analysisStatistics of scan engineNumber of seconds since the start of service = 174759The TCP connections followed by second rate = 0The rate of packets per second = 4711The number of bytes per second = 8402Statistics of receiverTotal number of packets processed since reset = 823334516Total number of IP packets processed since the reset = 822979042Statistics of the issuerTotal number of transmitted packets = 823478816Total number of packets rejected = 0Total number of packets reset = 0Fragment reassembly statistical unitNumber of fragments currently in FRU = 0Number of datagrams in FRU = 0Stream TCP reassembly statistical unitTCP stream currently in the embryonic State = 0TCP stream currently in the established State = 0TCP stream currently in the closing state = 0TCP stream currently in the system = 0The TCP packets currently queued for reassembly = 0Signature database statistics.Total active nodes = 16115Nodes matching the IP addresses and the ports TCP = 3438Nodes matching the IP addresses and the two ports UDP = 29Nodes matching the two IP addresses IP = 1715Statistics for Signature eventsNumber of SigEvents since the reset = 153308490For example in the 4270 we cross almost nothing the sensor... And his works not in mode Supreme. Why is the burden of Inspection that high? In the 4260 is the same... It works in mode Supreme... There are alarms for packets missed as well.I was see several discussions for the same reason, but none has a solution. The problem with the inspection workload is random. During the day, sometimes it high and sometimes low.Cisco Intrusion Prevention System, Version 2.0000 E4Update of signature S499.0Any notice will be really appreciated.Diego.Hi Diego,.
I would go ahead and open a TAC case at this stage we take a glance.
Best regards
JT
-
ASA-SSM-10 improvement no license or signatures
I successfully upgraded our ASA-5510 with the latest version of the software.
Our IPS module however ASA-SSM-10 seems to be the settings to factory default with only an IP address that is configured without any permission or certificates. The ASA-SSM-10 module can be improved with the lack of licenses or certificates? In addition, by using PuTTY I am able to connect to the ASA-SSM-10 module and ping the module and my laptop that I have connected via the management port. I am unable to ping from the laptop to the module of ASA-SSM-10 well.
Continuing the investigation in addition to the configuration of the management port IP address there is no VLAN, GW, image url or ip address of the configured port. Is there a simple way to upgrade the software on the ASA-SSM-10 without affecting our two ASA - 5510 that are configured for failover?
I suppose I can do up to a VLAN, GW and port address to get my cell phone to ping to the ASA-SSM-10 module to upgrade without affecting our ASA-5510 that are configured for failover. ***
You can attach more licenses for the legacy IPS until April 26. But the question is whether it is worth spending time and money in the present. The IPS legacy is dead and you should focus on firepower for IPS. But who does not work on your hardware.
-
Upgrade path 5500 series ASA-SSM-10
Can anyone provide the proper for the 5500 series ASA-SSM-10 upgrade path of
6.0 (5) E2
TO
7.1 (10) E4
The release notes state that you must run just least 6,0000 e4 could so I just spend 6,0000 E4 5,0000 E2 then directly to 7.1 (10) E4?
Also, the SSM-10 is able to effectively run the 7.1 (10) E4?
Hello
Yes, you can directly upgrade 6.0.5E2 to 6.0.6 E4 and then directly to version 7.1. (10) E4. After the upgrade for the latter, you might even go to latest available patch as well.
-Yes, SSM1 - is able to effectively execute the 7.1.0E4.
Kind regards
Akshay Rouanet
-
recharge an ASA - SSM the firewall itself effect?
We lost the connection information for the IPS - SSM on our ASA 5520. It seems we should re image module with a version more recent software. It is currently not in use i.e. no rules for it on the firewall. This process will take the firewall offline at all?
Sh command output:
See the module of Firewall03 # 1
Model serial number of map mod
--- -------------------------------------------- ------------------ -----------
1 ASA 5500 Series Security Services Module-20 ASA-SSM-20 xxxxxxx
MAC mod Fw Sw Version Version Version Hw address range
--- --------------------------------- ------------ ------------ ---------------
1 001b.0ce2.xxxx to 001b.0ce2.xxxx 1.0 1.0 (11) 2 5,0000 E1
The Application name of the SSM status Version of the Application of SSM mod
--- ------------------------------ ---------------- --------------------------
1 FPS up to 5.1 (5) E1
Data on the State of mod aircraft compatibility status
--- ------------------ --------------------- -------------
1 up Up
Firewall03 # display module 1 recover
Module 1 retrieve parameters...
Start the recovery Image: No.
Image URL:ftp://0.0.0.0/ t
Port IP address: 0.0.0.0
IP gateway address: 0.0.0.0
VLAN ID: 0
No, it should not affect the operation of the firewall at all. He would suffer only if you use it inline with firm failure mode is activated.
-
Cisco ASA-SSM-20 analysis engine error...
I get this error on my IPS, I restarted the couple times sensor but it stops again and signature updates do not move during this time, or it looks like. I've heard great Cisco ID: CsCuc34812 but there isn't really any information available on this subject. Any another race ASA-SSM-20 has experienced this problem and managed to resolve it?
Hello
All sensors should have a virtual sensor attributed to them, so they can inspect the traffic.
I have connected the IPS2 and ran the following commands to assign the virtual sensor
service-analysis engine
vs0 virtual sensor
physical interface gi0/1
That's right!
I guess that's how it should be? How 2 IPS has managed to send me notifications if there is no virtual sensors assigned to him?
We need to determine the type of notifications witch was the sending IPS (could be linked to the IPS himself, system notifications)
Is there a CLI to confirm the IPS is active? I have to assume that my upgrade caused these problems?
The SAA
Do sh-service policy and determine the number of packets is exchanged between IP addresses and ASA
Kind regards
-
20 IPS ASA - SSM password reset
Hi all
Must reset/recover the password to get rid, for some reason, we lost the password for the IPS 20 ASA - SSM module
Please let us know the procedure that the reset of password hw-module command does not work.
Use the reset passwrod hw-module command, you must have ASA 7.2.2 or later version.
-
Equivalent to show disk0: ASA-SSM-10
Hi, are you able to see the contents of the disc on an ASA-SSM-10 module? As the show disk0: command on my 5510? I know that it is an internal flash drive... Is that where the image files and configuration and software? Can we see these files and copy them to TFTP server?
See you soon
Phil
Hi Philippe,.
You can view this content through the service of IPS account. The downside is that you can access only with the supervision of TAC. If you want to see the configuration you can do a show config; If you want to see what version you are using you can do this through the show version command.
HTH
Luis Silva
"If you need IDP (planning, design, implementation) assistance do not hesitate to contact us.
-
Dear support,
I need to configure Security Services Module-10 (model: ASA-SSM-10) on my ASA 5510 firewall. Could you provide configuration step and how to connect to the module?
Here is the information on the module
ciscoasa (config) # sh Details of module 1
The details of the Service module, please wait...
ASA 5500 Series Security Services Module-10
Model: ASA-SSM-10
Hardware version: 1.0
Serial number: JAF1115066U
Firmware version: 1.0 (11) 2
Software version: 1.0000 E1
MAC address range: 001a.e268.5aa9 to 001a.e268.5aa9
App name: IPS
App status. : to the top
App status. / / Desc:
App version: 1.0000 E1
Data of aircraft status: Up
Status: to the top
Mgmt IP addr: 133.1.9.144
Web to MGMT ports: 443
Mgmt TLS enabled: trueyour help is very appreciate.
Thank you
Best regards
Hi Sothengse,
Please find the samlpe on AIP SSM module configurations. You can go through this to begin with.
http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...
https://www.YouTube.com/watch?v=FgYU5ZXwk4g
Concerning
Knockaert
-
ASA-SSM-20/40 IPS Software upgrade quesiton
I'm looking to upgrade the IPS modules (ASA-SSM-20 and ASA-SSM-40) on two different ASA to ver 7.1 (11) E4 under this field notice:
http://www.Cisco.com/c/en/us/support/docs/field-notices/640/fn64080.html
My question is around if traffic through the firewall is affected during this update and subsequent restart of the IPS module.
On the ASAs, a service policy is in place that will allow the traffic in the case where the IPS module becomes unavailable. It comes, it will actually happen during the update?
Suggestions and comments are welcome.
Thanks in advance.
John
If your IPS is inline and as a whole do not open then the traffic through the ASA (in assuming an ASA standalone and do not form part of a pair of HA) will not be affected when the service IPS module reload.
If an SAA is in a pair of HA and a service (ips, cxsc, or sfr) module fails, it will be by default triggers a failover event. (ASA 9.5 introduces the possibility to change this behavior.) The result is the same - no service interruption (Although TCP connections may need to restore if you have not configured stateful failover).
-
ASA-SSM-20 on the active failover configuration
You can synchronize configuration between two IPS systems data?
I have two ASA-SSM-20 (6.1.1 E3) one in each of my the SAA. Of the SAA is the shift in assets. During the configuration of the IPS module I always make these same changes also in the standby unit. Is it possible to synchronize to the top of these two survey periods, so when it is configured the other is updated?
Thank you very much
Unlike the SAA, there not an automatic function to preserve the configuration synchronization through SSMs 2.
A few options:
You can use the command copy to copy the configuration of a sensor to a ftp/scp server.
Then use the copy on the second sensor command to copy the configuration on the second sensor. During the copy, it will ask whether to change the IP of the probe to what is in the configuration file. You will need to tell it to NOT change IP of the probe, otherwise you end up with 2 SSMs with the same IP address and are struggling to connect to them.
Another option is to use the CSM. CSM has configuration that applies to simple sensors, but also the group configuration that can be applied across multiple sensors.
If you have used the group configuration, then you could make one change to the configuration of the Group and apply it in all the sensors in the Group (you will place your SSMs 2 in the same group).
-
Recording capacity for ASA firewall using ASA-SSM-20 IPS module.
Hello
Please could someone give some tips on how to get the ASA-SSM-20 to record information about something like Kiwi Syslog services etc. We just need to get the IPS alerts to generate the SMS/email feature to alert the various intervention teams.
Thank you
unfortantely, no syslog support
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807335ca.shtml
You can configure rules to send snmp traps, and you can pull events using CETS, IPS Manager Express and Cisco.
If you have logging enabled on the ASA a syslog msg appears when the IPS is asking or blocking traffic.
Here is a link to IPS configuration guides
http://www.Cisco.com/en/us/products/HW/vpndevc/PS4077/tsd_products_support_configure.html
-
Update license of IPS ASA - SSM
Hello
We have an ASA-SSM-20 IPS, the license has expired and we purchased a Smartnet contract for the device.
I would like to know how to upgrade the license.
We tried to do the ASDM, and chose the option updates to cisco.com.we got the following error.
internal error. Unable to send the license request. -4: unable to proxy transparent tunnel. Proxy returns "HTTP/1.1 403 Forbidden.
How to solve this problem or how to do when you use the other option, how to get the license file.
Best regards
It seems that your AIP-SSM20 is configured to use an http proxy to connect to the Internet. If you allow the IP address of the AIP-SSM20 management in your web proxy, it may solve your problem.
If this isn't the issue, you can always apply a license manually. Download your license file here:
https://Tools.Cisco.com/swift/LicensingUI/home
and apply via the ASDM or the CLI
-Bob
-
Down loaded CC version, after a few commands it freezes. Windows 7. Could you please help me?
reset your preferences:
Acrobat: http://help.adobe.com/en_US/acrobat/X/pro/using/WS58a04a822e3e50102bd615109794195ff-7feb.w .html
Dreamweaver: http://helpx.adobe.com/dreamweaver/kb/restore-preferences-dreamweaver-cs4-cs5.html
Flash: http://helpx.adobe.com/flash/kb/re-create-preferences-flash-professional.html
Illustrator: https://helpx.adobe.com/illustrator/using/setting-preferences.html
InDesign: https://forums.adobe.com/thread/526990
Photoshop: https://forums.adobe.com/thread/375776
Photoshop elements: https://helpx.adobe.com/photoshop-elements/kb/preference-file-locations-photoshop-elements .html
elements of first: https://helpx.adobe.com/photoshop-elements/kb/preference-file-locations-photoshop-elements .html
First pro: https://helpx.adobe.com/premiere-pro/using/preferences.html
-
JOINT inspection on 100% load
Now I have JOINT with 100% load on the rush hour and followed by missed packets percentage increasing at this time where inspection.
The JOINT interface puts as an interface promiscuity
It's my network throughput will be limited by the load max JOINT inspection / flow which is 600Mbps?
Thank you
Marcel.
No, the flow wil not be limited in the network when you are in promiscous mode. But your visibility for attacks is very limited.
You must configure your settings of term/capture on the 6 k 5 only send so much traffic that this module can handle the method.
Please keep in mind that the JOINT-2 is a system of ten years and cannot catch up with the typical traffic demand, we are having today. It's time to change the JOINT against a real external sensor.
Maybe you are looking for
-
Accounts Gmail became gradually more glitch as the time passed, I can open the page but cannot read my emails and continually refresh to see changes. I uninstalled and reinstalled Firefox twice, deleted the cookies and browser history, and there is n
-
Is it possible to block pages web spesific?
No details of which I guess...
-
I run a diagnostic test on this community of Linc Davis and here is the result... can someone otherwise Linc Davis himself make anything out of it? My macbook pro 15 simply began cause this random restart with no message or error before or after rebo
-
After unlock account, unabel to access MSN and hotmail
After summer, hotmail and MSN account unlock mine. I was not able to access hotmail and MSN mine
-
Recently, our computer has been infected with a variant of the Trojan Shield security. I removed the trojan using MalwareBytes, Spybot and AVG, but since that time, I can't get updates of windows, either by automatic updates (I checked to get the au