Is it possible to AIP - SSM, configure it to forward events to a syslog server

Similar Questions

• transparent mode with AIP-SSM-20

  I currently have an ASA5510 routed with AIP-SSM-20 mode.

  It is necessary to use a connection in optical fiber between the ASA and ASA on the campus, so the AIP - SSM will need to be removed and replaced by the SSM - 4GE.  This section should present no problems.

  However, this will remove the IPS device, and I always want to use IPS.

  So what I think is to get another ASA5510, install the AIP - SSM, configure ASA for transparent and put it between the inside of the ASA routed and my local network.  The ASA transparent would be strictly works in the form of an IPS appliance.

  The installation program should look like this:

  Internal LAN <> ASA transparent with IPS <> routed ASA <> WAN

  The AIP - SSM can always perform with the ASA in transparent mode IPS?

  Is it possible to configure the ASA and AIP - SSM such as traffic to and from a particular server completely ignores the AIP - SSM?

  I have a couple of file servers which generate heavy traffic and can overload the AIP - SSM.

  Kind regards.

  AFAIR, it is no installation AIP in a transparent firewall problem.

  "The SAA in transparent mode can execute an agreement in principle.  In the event that the AIP fails,

  the IPS will fail-open and the ASA will continue to pass traffic.
  
  However, if an interface or cable fails, then traffic will stop.  You
  
  would need a failover pair to account for this failure event, which
  
  means another ASA and matching AIP."
  
  

  And no there is no problem to exclude certain hosts/ports/subnets inspection by IPS via MPF.

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/configuration/guide/IPS.html#wp1050744

  What I consider however is however if the ASA 5510 as second level firewall for 5520 s will be enough.

  http://www.Cisco.com/en/us/products/ps6120/prod_models_comparison.html

  HTH,

  Marcin

• Do I need two AIP - SSM modules if I'm failover configuration?

  Is it possible to use a single module AIP - SSM in two ASA that is configured in active / standby?

  I would like to configure the module in the first ASA with the relief setting.  Then, if the ASA first fails, I could physically remove the module AIP - SSM and place it in the second ASA.

  Would there be problems, configure it in this way?

  Would be the active / standby ASA complaining that there is that one module AIP - SSM?

  Thanks in advance.

  Hello

  You must have an AIP - SSM on two SAA in order to be able to run the failover, without it failover will not come to the top (because of incompatibility of hardware)

  Kind regards

  Julio

• Help configuration AIP - SSM

  I have two questions about the AIP - SSM.

  (1) is the ACL in AIP - SSM has any type of relations to the ASA ACL?

  2) our four interfaces are all used. Is it possible to assign the SSM an IP address in the same subnet as the management interface?

  (3) should then the management interface serve as a gateway for the SSM?

  interface GigabitEthernet0/0

  nameif outside

  security-level 0

  IP address 65.x.x.1 255.255.255.0 watch 65.x.x.2

  !

  interface GigabitEthernet0/1

  nameif dmz

  security-level 50

  IP address 172.16.x.1 255.255.255.0 watch 172.16.x.2

  !

  interface GigabitEthernet0/2

  nameif inside

  security-level 100

  IP address 255.255.255.0 192.168.x.1 watch 192.168.x.2

  !

  interface GigabitEthernet0/3

  STATE/LAN failover Interface Description

  !

  interface Management0/0

  Speed 100

  full duplex

  nameif management

  security-level 100

  IP address 10.0.x.1 255.255.255.0 watch 10.0.x.2

  management only

  Here are the answers to your questions-

  (1) is the ACL in AIP - SSM has any type of relations to the ASA ACL?

  No of years) ACL on SSM is completely independent of the ACLs on the ASA.

  2) our four interfaces are all used. Is it possible to assign the SSM an IP address in the same subnet as the management interface?

  VNA) absolutely. You can assign the SSM management port IP address in the same subnet as your managemnet interface. In this way, all management traffic will remain independent of normal DATA traffic.

  (3) should then the management interface serve as a gateway for the SSM?

  VNA) you're right... :-)

  Hope that helps.

  Kind regards

  Maryse.

• AIP - SSM maintenance of Configuration in Active mode Stdby

  So, I'm pretty new to the AIP - SSM but not for the ASA. It seems that very few of the AIP module configuration gets copied to the AIP Stdby, nothing else that what appears in the config of the ASA (ACL, etc.). Thus, all elements of specific configuration for the module itself must be manually reproduced on Stdby module, either entered hand or config copies moved between the two?

  Planned in the future.

• Replication of configuration ASA AIP - SSM

  People,

  The AIP - SSM replicates another AIP - SSM ASA/standby configuration?

  I mean, when I change the configuration on the AIP/SSM assets, will change bring replicated to the other AIP - SSM?

  Thank you

  Yes, unfortunately all the IP addresses are the same. Configuration duplicate automatically 1 unit to another.

  Please kindly marks the message as answered if you have any other question. Thank you...

• Configuration of AIP SSM to monitor only

  Hi all

  We bought an AIP-SSM-20 for our ASA5520. Is there a way to enable the IPS feature, but not block anything, i.e. just record events? It's just to see if any legitimate business traffic will be blocked.

  Thank you!

  Jacques

  Set the ASA to send traffic to IP addresses in promiscuous mode by using the following command in a sheet of policy:

  IPS hostname(config-pmap-c) # {inline | promiscuity} {failure-closing |}

  rescue} [sensor {sensor_name | mapped_name}]

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/Getting_started/asa5500/quick/guide/aipssm.html

  Geroge

• NTP Windows Server and AIP - SSM

  We use a server based on Windows as the NTP server. But I need the NTP key to configure NTP on the AIP - SSM, key to the ID value and the NTP. How do you find this information or bypass? Or is it possible to set the clock without using an NTP server. I disabled the NTP service, hoping that it will use the firewall clock, but it didn't.

  Kind regards

  Your offset must be-360.

  The offset is in minutes rather than hours. Now, you say that the CDT is only 6 MINUTES from GMT when what you want-6 HOURS-360 minutes.

  offset - 360

• Cannot access the AIP SSM via ASDM

  CISCO recommendations below:

  Cannot access the AIP SSM via ASDM

  Problem:

  This error message appears on the GUI.

  Error connecting to sensor. Error Loading Sensor error

  Solution:

  Make sure that the IPS SSM management interface is up/down and check his IP address configured, default gateway and the subnet mask. It is the interface to access the software from Cisco Adaptive Security Device Manager (ASDM) on the local computer. Try to ping the address of management of IPS SSM IP interface on the local computer that you want to access the ASDM. If it is impossible to do a ping check the ACLs on the sensor

  ----------------------------------------------------------------------------------------------------------------------------------------------

  I've tried everything recommended above. I can ping the host ASDM the FW and the SSM-10 module. Well, I ping the host machine and the SSM of the ASDM. I opened as wide as possible ACL. I changed the IP addresses and masks several times. The management of the ASA port and the SSM and the PC are on the same subnet.

  A trace of package from the PC to the SSM shows that it is blocked by an ACL rule, and yet I opened wide.   I've seen this kind of problem before and it was solved by applying the double static NAT, but I don't know how to do that if all the IP addresses are on the same subnet.

  Tried everything, need help from high level.

  The IDM software that comes with ASDM does not support java 1.7. The portion of the ASDM ASA supports 1.7 but launch the IPS cmdlet works only with 1.6. The TAC enginner suggested that I use the IME (IPS Manager Express) which is available for free on the Cisco's (http://www.cisco.com/en/US/products/ps9610/tsd_products_support_general_information.html) Web site.

  I've been playing with it today, and so far it seems to work pretty well.

• AIP - SSM recreate the image in secondary ASA 5500 (failover) with virtual contexts

  Hello guys,.

  The scenario is as follows:

  2 ASA 5500 with virtual contexts for failover.

  The ASA elementary school has the work of the AIP-SSM20.

  ASA school (which is in active / standby) has its SSM20 AIP to work now and everything is in production.

  Someone tried to configure this 2nd AIP - SSM, changed the password and lost, so I tried to re - the image (without authorized passage recovery), but the connection fails on the TFTP server, where is the image of the AIP - SSM.

  Now questions, documentation Cisco re-imaging view orders under ASA #.

  but as this scenario has several virtual contexts the ASA # shell contains no IP address as you know (which I suppose is the reason why the ASA cannot download the image from the TFTP server) and switch to another context (ASA / admin #) re-imaging commands do not work (hw-module module 1... etc...).

  What is the solution? Is there documentation for it (with security contexts)?

  Thank you very much for reading ;) comment on possible solutions.

  Yes,

  Some things to keep in mind.

  (1) run 'debug module start' on the SAA before running the command "hw-module module 1 recover boot. This will show you the ROMMON of the MSS output as it tries to make the new image and you can look for any errors.

  (2) before trying to download from the SSM, first use a machine separate download tftp from your laptop. This will ensure the TFTP on your laptop works and confirm what directory (if any) that you can use as the file location.

  (3) if the tftp download does not SSM, then the SSM is unable to properly connect to your laptop. You need a crossover cable to connect your laptop to the SSM. If you have a crossover cable, then you could try to connect the MSS and your laptop to a small hub, or configure a new vlan on your switch with only 2 ports and connect the MSS and your computer laptop this vlan 2 port.

  (4) also try the download first at the end of the gateway to 0.0.0.0 since your laptop and the SSM will be on the same subnet. If this does not work then you can try a non-existent 30.0.0.4 address as gateway.

  (5) understand that the IP address that you specify for the MSS using the command "configure the hw-module module 1 recover" is just temporary for download. Once an image is installed, then sitting at the module and run the "setup" command in order to configure the permanent address you want ure on external port of the SSM. This address in the "setup" command can the same as that used in the command 'get the 1 hw-module module configure' or a completely new (as in your case). Just make sure that you connect to the network just to what address you give.

• The AIP - SSM to unused ASA connection interface

  Hi people,

  Perhaps, someone has already raised this issue, but I was unable to find anything relevant. We have an ASA with an unused interface (gig0/3). The sensor of the AIP - SSM is physically connected to this interface with the following IP settings:

  Sensor (192.168.2.2/30,192.168.2.1)---interface ASA (192.168.2.1/30)

  It's basically point to point connectivity, and I can reach the ASA of the sensor and the other way around.

  This design is dictated by the lack of a free port on the switch.

  Technically, it should work without any problems, but I can't seem to be able to reach the sensor. There is a switch between my PC and the sensor and the switch has the corresponding static route added. I can reach the switch sensor.

  Is there a security feature hidden I don't know that prevent communication with the sensor.

  And ACL of the sensor allows the traffic to all networks (0.0.0.0/0)

  With the sensor acl set to 0.0.0.0/0, the sensor must be allowing connectivity.

  You can use the 'View of package' command on the sensor to look at packets on the interface command and control to see if the packets are what makes the sensor.

  You say that you have a static route on your switch for the switch reach your sensor. Do you know if your PC is configured to use the switch as the computer's default router. If the PC is to use a different default router, then the other router should also the static route.

  The other possibility is that the SAA itself can be deny traffic.

  Since this is an ASA connected to the MSS interface, the traffic must be routed through the ASA. Standard firewall rules apply to this traffic. The security level of the interfaces can prevent traffic, and an ACL may be necessary in order to allow the circulation of your PC be routed to the SSM.

  NOTE: If you don't want to have to worry about roads, the other alternative is to make the network between the ASA and SSM to be an isolated network that only 2 machines know.

  You can then use PAT static to map a port on the inside of the ASA interface with the address of the SSM 443 https port and map a second port of the SAA within the interfaces to the address of the SSM SSH port.

  How your home PC would simply plug the ASA IP using these specific ports and the ASA would do the translation of port and transmit on the MSS.

  The SSM address could also be dynamically PAT would have on the SAA within the address, so SSM could start the connection to other machines on the inside network.

  Another alternative if you have addresses available on your inside network IP is to use static NAT instead of PAT. And just go forward and has the ASA statically map an IP network on IP of the SSM on the network that only the ASA and the SSM inside could know.

  In both cases the network between the ASA and SSM would not routable at, and you wouldn't have to worry of reproducing static routes anywhere.

  SIDE NOTE: A separate network for the SSM you Becase you will also need to NAT or PAT address of the SSM for the ASA to outside interface. In this way the SSM will be able to connect to Internet to download cisco.com auto updates, and/or pull overall correlation of servers cisco information. It's probably the same configuration that you would already other internal addresses, and just to be sure, you cover the SSM since you have it on a separate subnet.

• Module AIP - SSM hung

  Hello

  I recently confgured my module AIP-SSM-40 in my firewall that is configured in HA(Active/Standby). It was working fine. Then, I upgraded the version of the image to IPS, 2.0000 E3.

  It worked fine for a week. Then I found that the secondary firewall was in a State of secondary failure. My AIP - SSM in the secondary firewall fails.

  I couldn't connect the AIP - SSM with command session 1. Display the order watch module

  Model serial number of map mod
  --- -------------------------------------------- ------------------ -----------
  0 ASA 5520 Adaptive Security Appliance, ASA5520

  1. ASA 5500 Series Security Services Module-40 ASA-SSM-40

  MAC mod Fw Sw Version Version Version Hw address range
  --- --------------------------------- ------------ ------------ ---------------
  0 0021.a09a.d1bb for 0021.a09a.d1bf 2.0 1.0 (11) 5 8.0 (4)
  1 0023.5e15.f6c8 to 0023.5e15.f6c8 1.0 1.0 (14) 5

  The Application name of the SSM status Version of the Application of SSM mod
  --- ------------------------------ ---------------- --------------------------

  Data on the State of mod aircraft compatibility status
  --- ------------------ --------------------- -------------
  0 to Sys does not apply
  1 does not not Applicable

  at the end of the failover see command shows

  Slot 1: ASA-SSM-40 rev hw/sw (1.0 /) status (does not/high)

  I suspect module SSM is having the problem. Is it possible to recover.

  Try to stop and reset the module using this command from the ASA:

  HW-module module 1 reset

• AIP - SSM on contexts or transparent

  Hello

  I would like to know if its possible to have a module AIP - SSM on a SAA configured in transparent mode and if its possible to have in several contexts. Two different scenarios. The customer wants to know who, and I'd like to see if possible on a document from Cisco. I think that both scenarios are possible, but I have not found any document.

  Thank you

  Paul

  Hi Paul,.

  Here is the link that explains how you can configure multiple virtual devices and as you can see that it is supported on both put to rout and the transparent mode.

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/configuration/guide/IPS.html#wp1087111

  I hope this helps.

  Thank you

  Sunil-

• Backup of AIP SSM

  Hi all

  recommend the best way to save the AIP SSM Module.  is it possible to automate it?

  Thank you

  If you use Cisco Security Manager, it'll keep a copy of the working configuration that can be redeployed to a replacement sensor.

  If this isn't the case, you can always make a screenshot of the output of "show config" CLI.

  Sticky which in a spare sensor will restore your config, just like a switch or a Cisco router.

  There are a lot of scripts that are available for this for routers, edit them to change the "show run" command to "show config" would be pretty easy.

  -Bob

• ASA5510 and AIP-SSM-10 module in promiscuous mode

  Hello

  I have a 5510 ASA with the AIP-SSM-10 and want to use just like an ID in promicuous mode.

  ASA 5510: ASA version 7.0 (8)

  AIP-SSM-10: IPS version 5,0000 E2

  At this point, we would like to configure a single interface of ASA to send traffic to the agreement in principle for the inspection of IDS (and continue to use our firewalls third existing). Is this possible?

  The following discussion gives to think this isn't:

  https://supportforums.Cisco.com/message/957351

  22.1.100.2/28 I have it configured on the interface Eth0/0 (outside) and 10.5.100.3/24 on the AIP - SSM management interface and switchports (Cisco 6509) have been configured by SPAN.

  Thanks for your advice in advance.

  Kind regards

  Lay

  You are right. Unfortunately, module AIP on ASA firewall does not listen on traffic SPAN. If you want that SPAN ports, then you can use the IPS (IPS 4200 series appliance) appliance that supports the SPAN traffic to inspect.

  PIX is also a firewall, not a feature of IPS, which cannot be used as an IPS device.