Check the IPS configuration

I am very new on the front of Cisco IPS and have configured an ASA 5510 with the SSM-10 IPS module.  We have a compatible interface with multiple VLANs on this interface.  I installed the IPS, to the best of my ability, and I think it's okay as inline doesn't open in a configuration of active / standby asa.  Is it possible to check that the traffic flows properly to this IPS module?  Also, I've mentioned on the Setup it of because this version of the IPS, if I understand correctly, will not allow pairs VLAN, then when I put the policy to inspect all traffic, this traffic inspected between all the VLANS.  Another mystery, this is when I discovered my IPS interfaces (management and is not) that is not configured as management shows no matched.

I know it of a lot, so let me summarize:

-How can I check that my setup works as intended where all traffic between all them VLAN is inspected.

-Why my interface managers showing 'matched '.

-Looking through all of the Cisco documentation, I noticed the mention of the "contexts"; I don't see any reference to these contexts within the IDM.  It's just for my knowledge, but may be necessary for installation... I do not know.

Thank you!

Hello Mote, heat

With regard to your questions:

-How can I check that my setup works as intended where all traffic between all them VLAN is inspected?

Since you're using an IPS module, traffic that matches the class configured on the SAA is under inspection, you can configure a capture on the dataplane Interface (the Interface used to send traffic to the ASA to IPS) using this command:

capture ips int asa_dataplane buffer 15000000

Check capture using the:

See the FPS capture

The output should display the packets from for each VLAN.

-Why my interface managers showing 'matched '?

Modules ASA IPS (ASA 5500 AIP SSM, ASA IPS 5500-X SSP and ASA IPS SSP 5585-X) do not support pairs VLAN inline.

You can associate a VLAN in pairs on a physical interface. This is known as pair mode for the VLAN inline. Packets received on one of VLAN matched are analyzed and then forwarded to another VLAN in the pair. Because the module has only a detection interface, this is why it is shown as Unpaired.

Literature speaks of "security contexts. You can partition an ASA unique in several virtual devices, called security contexts. Each context is an independent device, with its own security policy, interfaces, and administrators. Several contexts resemble have several stand-alone devices. Many features are supported in multiple context mode, including the routing tables, features of firewall, IPS, and management.

Please rate the answer if you find it useful.

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • Mid-2013 13 "Macbook Pro unusable slow, beachballing"

    I would appreciate if anyone could help out... my mid-2013 13 "Macbook Pro became unusable. It is slow to start, slow down open apps, slow to react and the spinning beachball at any time, there is an action of the user. I can't attach the degradation

  • How will I know if my pci DSS goes

    How will I know if my pci DSS goes wrong and there is a cheque that I can do?

  • Drive hard squeal

    I have a Satelite PSA10E - 018G 3 - SO with a hard drive that suddenly during a session of Windows XP ordinary slowed to a halt, causing the machine to freeze, and whenever I tried it from now to the top, it will alternate between doing weird little

  • FTP back script

    Hello I have a question on using ftp I recover openg tools it works but terribly long more than 3 s for a 1 KB file so I took a glance at the back command line with exec system palette. I have It works well (~ 250 ms) but I am forced to use scipt fil

  • What is IQ Updater?

    I was doing a contextual command prompt: "IQUpdater is available - install now?  I continue to click No., but he continues to display.