New AIP-SSM10

Similar Questions

• AIP - SSM 10 Signature Update license?

  Hi every one.we had an AIP - SSM 10 for our asa5520.actually it is bundle asa5520 + AIP-SSM10. (part number ASA5520-AIP10-K9 =)

  (1) I want to know that if we want to improve our signature aip - ssm we get the Services Cisco IPS download signatures or not with this number of pürt we get it too!

  (2) in the case and we must get the Cisco IPS services separately so where can I find a reference number for the services of this?

  (3) what license that must be installed on the sensor activation? If we get the Cisco Services for FPS then we receive license activation for installation on sensor too? or not if not, can we install signatures on a sensor that it has not been activated yet? guess we can get a few signatures how! (I know JOINT-2 we cannot install any license until the license is installed on the sensor.) Thank you

  CON-SU1-AS2A10K9 would be the correct contract to put all the pieces of the boot under the maintenance contract.

  CON-SU1-ASIP10K9, this is what is used when the AIP-SSM-10 are purchased as spare.

  I don't know if yes or no this Service Cisco IPS contract can be used to cover only the AIP-SSM-10 if it was purchased as part of a package instead of a spare part. You will need to ask your reseller or Cisco sales representative.

• Version of signature IME not updated

  Hello

  I have the following problem with IME:

  I have 5 AIP-SSM10 managed by the EMI and out of the version 2 see the older signature (387) on the dashboard however when I apply the State it show tha latest (397).

  A similar problem?

  Thank you

  Kris

  It is a known issue:

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq53214

  To bring them to phase once again, you will need to reboot the sensor. For some reason any code on the sensor (which is responsible for the information of the dashboard) health surveillance does not correctly detect the installation of the update of the signature. A restart requires a restart of the health monitoring code and then correctly reads in the current level of update of the GIS.

  Understand, however, that the reboot is just a temporary solution, and it can always happen again.

  This doesn't always happen. I don't know if the developers know yet what causes this to happen.

  If this question consitently recreates itself on your sensor, then you could try calling the TAC. Your sensor could help development in the debugging issue.

• New deployment with the ASA and AIP - SSM module

  Hi guys and girls,

  I think to deploy an ASA with IPS module AIP - SSM to my perimeter. I'm going to use / * Style Definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;} Cisco IPS Manager Express (IME) to monitor the IP addresses to monitor the ASA. I have no plans on deploying a device IDS.

  Question: The IME is designed to send notices to the subject of threats? What are some of the configurations in your network? (Just prick with the last question.)

  THX...

  IME is designed only for IPS monitor (whether it be IPS appliance, module AIP - SSM on ASA or other module IPS). IME is not able on the control of ASA.

  EMI can provide advice by email about events which are fires on the IPS, while the IPS itself cannot. EMI may also keep all the events triggered by the IPS, while SPI buffer is small enough, that so if you have huge demonstrations, the buffer gets replaced pretty quickly.

  Here is more information about IME, if you are interested:

  http://www.Cisco.com/en/us/products/ps9610/index.html

• AIP - SSM maintenance of Configuration in Active mode Stdby

  So, I'm pretty new to the AIP - SSM but not for the ASA. It seems that very few of the AIP module configuration gets copied to the AIP Stdby, nothing else that what appears in the config of the ASA (ACL, etc.). Thus, all elements of specific configuration for the module itself must be manually reproduced on Stdby module, either entered hand or config copies moved between the two?

  Planned in the future.

• AIP - SSM recreate the image in secondary ASA 5500 (failover) with virtual contexts

  Hello guys,.

  The scenario is as follows:

  2 ASA 5500 with virtual contexts for failover.

  The ASA elementary school has the work of the AIP-SSM20.

  ASA school (which is in active / standby) has its SSM20 AIP to work now and everything is in production.

  Someone tried to configure this 2nd AIP - SSM, changed the password and lost, so I tried to re - the image (without authorized passage recovery), but the connection fails on the TFTP server, where is the image of the AIP - SSM.

  Now questions, documentation Cisco re-imaging view orders under ASA #.

  but as this scenario has several virtual contexts the ASA # shell contains no IP address as you know (which I suppose is the reason why the ASA cannot download the image from the TFTP server) and switch to another context (ASA / admin #) re-imaging commands do not work (hw-module module 1... etc...).

  What is the solution? Is there documentation for it (with security contexts)?

  Thank you very much for reading ;) comment on possible solutions.

  Yes,

  Some things to keep in mind.

  (1) run 'debug module start' on the SAA before running the command "hw-module module 1 recover boot. This will show you the ROMMON of the MSS output as it tries to make the new image and you can look for any errors.

  (2) before trying to download from the SSM, first use a machine separate download tftp from your laptop. This will ensure the TFTP on your laptop works and confirm what directory (if any) that you can use as the file location.

  (3) if the tftp download does not SSM, then the SSM is unable to properly connect to your laptop. You need a crossover cable to connect your laptop to the SSM. If you have a crossover cable, then you could try to connect the MSS and your laptop to a small hub, or configure a new vlan on your switch with only 2 ports and connect the MSS and your computer laptop this vlan 2 port.

  (4) also try the download first at the end of the gateway to 0.0.0.0 since your laptop and the SSM will be on the same subnet. If this does not work then you can try a non-existent 30.0.0.4 address as gateway.

  (5) understand that the IP address that you specify for the MSS using the command "configure the hw-module module 1 recover" is just temporary for download. Once an image is installed, then sitting at the module and run the "setup" command in order to configure the permanent address you want ure on external port of the SSM. This address in the "setup" command can the same as that used in the command 'get the 1 hw-module module configure' or a completely new (as in your case). Just make sure that you connect to the network just to what address you give.

• AIP SSM and virtual devices

  I just put in place a module AIP SSM in an ASA 5520 with a unique security context.

  Do I need to configure virtual devices in this case? or I can use the VS0 default? In the documentation of the IPS, he says "You can't change the definition of signature, rules of action event or anomaly detection policies." for the default virtual sensor (VS0), which is the only virtual sensore I.

  Can someone clarify what this means? It somehow restrict the usefulness of the IPS if I do not set up a separate VS?

  Thank you very much.

  A single sensor vs0 virual is very good, especially when only a single surveillance security context.

  The statement do not change the definition of signature, event actions or policies of anomaly detection rules can be a little misleading.

  What he's trying to say, is that you cannot create ad1, regles1, and any new polcies sig1 and try to apply them to vs0. The vs0 default must use sig0, rules0 and ad0.

  If you have created a new vs1, then you can apply the new policies like sig1 and regles1 ad1 to this new vs1.

  This does NOT mean that you cannot make changes to config in sig0, rules0 and ad0.

  So feel free to make configuration changes to sig0, rules0 and ad0 to fine-tune how your vs0 should handle the traffic.

  It's just the names of politicians who cannot be changed when you use vs0.

• CSM up-to-date IPS AIP - SSM

  Hi all

  I need help. I'm setting up my 3.1 CSM to apply the update on my IPS AIP - SSM.

  I went to the FPS tab apply and choose Update cisco.com. But it's still as treatment for a long time.

  I tried to enter my username and password for the sensors or account of the BCC but still no improvement. Anyone know how to configure it. I tried to read the user guide there is no examples.

  Thank you

  The two IPS - K9 - 5.1 - 8.pkg abd IPS-SSM_10-K9-sys-1.1-a-5.1-8-E3.img will recreate the image on the partition recovery and the application partition.

  The System Image will erase everything before starting the imaging process.

  The Service Pack Upgrade file will first of all take the current configuration and convert it to work with the new version and save off the coast. Also several other special folders on the sensor (for example, the license file) will be saved off the coast. The imaging process will run and then the saved to the large files will be automatically applied to the probe.

• New on IDM

  Hello

  I'm new IDM

  We have an ASA 5520 with module 10 IPS.

  I wanted to know how the traffiic will sink in & out

  My thoughts: from the outside Internet > IPS > FW > LAn

  is it good?

  Hello

  Well, you can configure the IPS module of the asa cli only. It is based on the desired mode. promiscous or inline.

  If you configure mode promiscous a copy of the package is sent to the module AIP-SSM-10, in this case it will act as IDS.

  If you configure in inline mode, then the traffic comes from inside and outside the ASA interface, then it will be sent to the module AIP-SSM-10, but do not forget to configure "bypass mode on.

  load will always be there on the firewall because the module is integrated.

  and he has to transfer traffic to the module.

  hope that your doubt is cleared.

• Cisco ASA AIP SSC-5 (ASA5505)

  Hello

  I read in the new code asa version 8.2 has support for SSC-5 AIP news, dug deeper and it seems that cisco had released the SSC-5 for the firewall ASA5505 AIP... but I don't seem to find a seller to purchase a. Is this map yet available on the market?

  B.regards

  The card was announced and canbe read in the data sheet:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916.html

  But is not yet available for purchase.

  8.2 ASA was previously published, and then the period allowed for the completion of the production with the final release code.

  Once completed, the SSC-5 will be ordered.

• Nightmare config of SSM - AIP 7.0 (1) overall correlation.

  Thank you, Cisco, for the creation of a nightmare of management with your "Overall Correlation" option in version 7.0...

  Lets start with the management interface of the AIP-SSM-20...

  We have an OOB management network, with a single PI in this by another device of PIX515E. Both the ASA5540 AND the AIP-SSM-20 are in this network.

  The first issue was in routing, as the ASA sees the "directly attached" management network, and we ROUTE traffic via the PIX of updates on the SSM module, we had to add translation entries in the PIX515E for the SSM (management 10.x.x.x, translated of 172.x.x.x) module.

  It wasn't a big deal, but this is where the nightmare begins...

  First a note: we have locked network management CLOSE, only a few network management stations authorized in this network to access these devices.

  I activated the overall correlation in test mode, but it was 'impossible' whenever he tried to update... Reading other posts, I created ACLs and static NAT in the PIX515E for these IP addresses:

  204.15.82.17 (IP listed in the IME global correlation update server)

  97.65.135.170 et.137 (from another post in these forums)

  207.15.82.17 (IP found in a trace)

  Still no update. Research in the papers of PIX, I found "no translation" entries for the following addresses:

  198.133.219.25

  209.107.213.40

  208.90.57.73

  I put these in, and he started to be updated! FIXED? NOT!

  This morning, he wasn't yet... Looked again into the PIX logs and found these:

  77.67.85.33

  77.67.85.9

  Registered, and the SSM is happy again. How long? Who knows?

  So, now I have NINE holes in my 'secure' network, and who knows what Cisco will change or add new IP addresses to this list.

  Cisco, if you listen - ALL access to the overall correlation with a single IP address? PLEASE?

  (use the one listed in the IME - 204.15.82.17 for the URL "manifests.ironport.com" - updated)

  Some of the addresses are owned by Cisco (initially ironport.com addresses the acquisition of ironport) and are used as clear servers to provide the sensor a list of files to download.

  The sensor then downloads the files from servers Akamai. Akamai has a large number of servers around the world. Cisco sends the update of Akamai, and they reproduce on their servers. When the sensors are trying to connect to the Akamai server it is a DNS query and by controlling the DNS response, it can lead more sensors to an Akamai server located near the sensor. This allows better load balancing, response time and download speeds.

  However, Akamai has a large number of global servers (in thousands I think), and you can't predict what your specific sensor server is directed to.

  Sensor for connections to the servers from cisco for the manifest (list of files) is on port 443 and usually the update URL - manifests.ironport.com.

  Sensor connections to Akamai servers for actual file downloads are on port 80, and usually to the updates.ironport.com URL.

  The above is based on my limited knowledge of the operation between the updates. I may have gotten the details slightly wrong, but should at least give you a general idea.

  I will work with development to get to this better documented in the Release Notes and the Readme with the next version of the IPS software.

• installation of update of signature for JOINT-2 AIP - SSM

  Hi every one, im not sure about this issue but I think its beter ask you experts.i want to know that if I update the signature for example for my JOINT-2 can I install this update of GIS on my AIP - SSM--> assume that software IPS on both devices are same and I also installed the license key valid on AIP - SSM.now can I do this or not? and I know that if you do not license installed on JOINT-2 you cannot install any point of GIS on JOINT-2 but this topic AIP - SSM? I want to say I can install updated GIS on AIP - SSM without installed the license key valid on AIP - SSM? Thank you

  There are 3 main types of Signature updates.

  (1) IPS sensor Signature Update

  (2) updates of Signature CSM for IPS sensors

  (3) signing IOS IPS updates

  The IPS Signature Update file name is in the form: IPS-GIS-Sxxx-req - Ey.pkg

  That's probably what you are referrnig to in your message. This file can be installed on ANY device IDS/IPS or Module.

  Here, the requirement is not the platform but rather the level of the engine. The part "req - Ey" in the file name indicates that the sensor has already run the 'y' the software engine level.

  If a file IPS-GIS-S436-req - E3.pkg can be installed on any IDS/IPS device or Module as long as the software on this sensor is a version of the 'E3 '.

  The CSM updates are updates of signature for the Cisco Security Manager. They contain special files that SCM uses to update, and then also included in the JLC update is the update of real sensor described above. CSM unpackages the CSM update, updates and then uses this file embedded to upgrade the actual sensor.

  The third type of file is for routers IOS loaded with the special IOS software that has the distinction of IOS IPS where the router itself (instead of a separate module of the IDS/IPS) keeps track of the signature.

  These updates to the signing IOS IPS settle on the real router and are not installed on the Modules or the sensor IDS/IPS devices.

  So to answer your question, yes the same Signature Update for your JOINT-2 is the exact same Signature Update for your SSM modules.

  The same exact file is available through several different paths on cisco.com. But no matter which way cisco.com you have downloaded the file, you can always install it on all the Modules and the IDS/IPS Appliances.

  With respect to licensing, the license works the same on all Modules and the IDS/IPS Appliances. A license must be on the sensor for the Signature Update to apply.

  NOTE: A trial license is available at cisco.com for new sensors to allow you to get everything set up properly for your sensor to be covered by a service contract and get the standard license for the service contract.

• Question of the clock of the AIP - SSM

  We have configured our AIP - SSM and synchronized with our command NTP servers.show clock shows the time corrcet in the CLI

  See the sensor clock #.
  16:42:35 GMT + 05:30 Sunday, March 28, 2010

  probe # show clock detai
  16:53:25 GMT + 05:30 Sunday, March 28, 2010
  Time source is NTP

  But the time indicated in the last TAB update shows the hour UTC. Even in my case logs are updated with the time information UTC only. I set the time zone correctly.

  

  What do I need to configure something else to update my timestamp in the event log.

  In the second version of the IPS, a new column has been added for "time sensor" in the event viewer.

• ASA 5510 with AIP SSM-10

  I'm new to network administration and our company has an ASA 5510 with and map AIP SSM-10. On the interface ASA when I try to load Intrusion detection, he said the following:

  "For IPS 5.1 (1) S205.0, use the link below to access the IPS Device Manager." (If the SSM management IP address or the port is translated, replace them accordingly in the below URL). IPS 6.0.1 or above will be fully interated ASDM. »

  Unfortunately, no URL is displayed below this message and there is no documentation in the company that owns this configuration. Is there a way to reset the AIP without resetting the ASA? How can I find the IP address to be able to configure it?

  The ASA CLI, you will be able to check the IP address of the AIP module:

  view the details of the module

  It will show you the ip address of mgmt of the module, and you can https to the IP address of your PC.

• where connect AIP - SSM 10 MODULE INTERFACE

  Hello

  We have CISCO ASA 5520 model with Module AIP - SSM 10 IPS, I'm new to IPS,

  1. I do not know where to connect from this port module (connectivity) another port it should connect to any router interface or L3?

  2. which IP address to use, it should be accessible network IP or customer?

  3 and the functioning of the IPS. ?

  with kindness is - anyone can guide me.

  Hello

  You will need the credentials of EAC by means of which you should be able to connect to www.cisco.com

  SPSP