The ACE IPS Cisco and Cisco ASA AIP - SSM (IPS)

Similar Questions

• Cisco ASA aip - ssm signature update

  Hello

  Is it possible to dynamically update the signatures directly from Cisco IPS? I can only find configuration guides where the IPS module queries an internal server...?

  Thank you

  Ash

  Yes, you can update IPS signature directly from cisco.com if you run IPS version 6.1 and higher.

  This is the configuration for your reference doc:

  http://www.Cisco.com/en/us/docs/security/IPS/6.1/Configuration/Guide/IDM/idm_sensor_management.html#wp2182927

• Physical connectivity of ASA AIP - SSM

  How the physical connectivity of ASA AIP - SSM should be in the case of inline interface mode of inspection for all interfaces of the firewall. ?

  Rgds.

  Assuming that 'interface_policy' has "inline ips" in the policy, then yes your configuration is correct.

  Keep in mind that 'GigabitEthernet0/1' being assigned to vs0 is the background interface of basket of the MSS itself and should not be confused with the external interface GigabitEthernet0/1 of the SAA.

  As for using several virtual probes, it is a personal choice.

  When you use an ASA with just a single context, then usually a single virtual sensor is sufficient. It's only when you want to follow for traffic coming from firewall interfaces (or different classes of traffic) If you want to use several different virtual devices.

  However, when you use an ASA with multiple security contexts, then it is usually a good idea to go and use a virtual sensor separate from the context of the ASA.

  If you choose to use several virtual devices, you must understand that the background basket interface GigabitEthernet0/1 are only awarded to only 1 virtual sensors.

  Here is an explanation of how the other virtual sensors would get traffic:

  When packets are sent to DFS for monitoring ASA, ASA includes a special header in each packet. Special information such as the framework of the SAA whence the package, the real and NAT/PAT package addresses, and a few other things. An important field of this header is for the virtual sensor. He tells the SSM which virtual sensor must monitor this package.

  When the ASA is configured without using the names of virtual sensor, this is a virtual sensor in the package header field is blank. If the SSM sees a package with the field left blank it will check the DFS configuration to see which virtual sensor GigabitEthernet0/1 of the SSM has been assigned and that sends the packets to the virtual sensor.

  If ASA has been configured to send the packet to a specific virtual sensor (be it by adding the name of virtual sensor at the end of the "inline ips" entered configuration or by using the configuration entries "allocate ips" in the context of system configuration) then the ASA will include the virtual sensor in the header of the packet. The SSM will read in this area, and instead to send the virtual sensor where Gig0/1 is assigned, it will rather send to virtual sensor specified in the header of the packet.

  Indeed, it overrides the assignment Gig0/1 and will lead to what ever virtual sensor has been specified by the configuration of the SAA.

• The traffic load between the power of Cisco ASA and FireSight Management Center fire

  Hi all

  I have a stupid question to ask.

  Can I know what is the traffic load and the e/s flow between firepower Cisco ASA and FireSight Management Center?

  Currently working on a project, client require such information to adapt to their network. Tried to find in the document from Cisco, but no luck.

  Maybe you all have no idea to provide.

  It varies depending on the number of events reported from the module to the CSP. No event = only health controls and policy changes are exchanged. 10,000 events per second = much more traffic.

  Generally it is not a heavy load, however.

• Cisco ASA AIP SSC-5 (ASA5505)

  Hello

  I read in the new code asa version 8.2 has support for SSC-5 AIP news, dug deeper and it seems that cisco had released the SSC-5 for the firewall ASA5505 AIP... but I don't seem to find a seller to purchase a. Is this map yet available on the market?

  B.regards

  The card was announced and canbe read in the data sheet:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916.html

  But is not yet available for purchase.

  8.2 ASA was previously published, and then the period allowed for the completion of the production with the final release code.

  Once completed, the SSC-5 will be ordered.

• Block P2P software using the ASA-AIP-SSM-20 module

  Hello

  I have a question about blocking P2P traffic on ASA AIP module. I've searched the forums and all I could find were solutions using regex, port block, MPF, but no example of implementation of AIP.

  Could someone point me in the right direction please?

  Thank you very much

  Martin

  Hello

  You can find all the associated p2p signatures in:

  http://Tools.Cisco.com/Security/Center/home.x

  A search using Signatures, p2p, all. Then, you can set the respective signatures to your needs.

  SPSP

• Rules of politics on the ASA AIP - SSM services

  Salvation of the forumers

  I have an ASA with AIP - SSM. I want to protect the LAN private outside the internet attack.

  I would check the meaning of the ACL on ASDM firewall > policy of Service rule

  1. am I right to set the source: external interface, destination: 172.16.0.2

  or 2. destination value: 10.10.0.0 / 16

  Thank you

  Noel

  To respond to your request in simple just do your Service policy with the IP address that is seen by the firewall. If the IP address 10.10.0.0/16 are natted on the router with 172.16.0.2, then all IP addresses, hit on the firewall will be 172.16.0.2 so make your destination with 172.16.0.2 else if the natting is on the firewall for 10.10.0.0/16 then point the destination to 10.10.0.0/16.

• (ASA) AIP - SSM 10 Inline; Supreme events?

  A 5520 ASA with SSM-10 GOAL is set to inline mode, but the events of the show for 2 hours (sensor > HS event past 02:00) of the Interior of the sensor shows and "promicuous mode", "left promicuous mode'."

  This AIP SSM - 10 has only one gig0/0 and gig0/1 where o/o is taken out of service and a value default virtual sensor (vs0) is assigned to gig0/1. I see the statistics (sensor > sh SEO-engine of analysis) to gig0/1 so I collect statistics.

  If the configuration of the ASA 5520 has the following policy of inline and events log shows that enter and exit in promiscuous mode so how do I check if I am inspection/recovery in inline mode?

  (ASA > sh run access-list IPS)

  IPS list extended access permitted ip DMZ 255.255.255.0 26.26.1.0 255.255.255.0

  (ASA > sh run | b class-map)

  class-map IPS

  corresponds to the IP access list

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  inspect the waas

  inspect the icmp

  class IPS

  IPS inline help

  !

  global service-policy global_policy

  (sensor > sh interfaces)

  ...

  Statistics interface GigabitEthernet0/1 MAC

  Function of interface = interface detection

  Description =

  Support type = backplane

  By default Vlan = 0

  Inline = unpaired mode

  Pair of status = n/a

  Circumvention of Capable hardware = no.

  Twin derivation material = n/a

  Link status = upwards

  Link speed = Auto_1000

  Link Duplex = Auto_Full

  Lack of Packet percentage = 0

  Total packets received = 95044

  Total number of bytes received = 8715230

  Total multicast packets received = 0

  Total of broadcast packets received = 0

  Total fat packets received = 0

  Total sousdimensionnés packets received = 0

  Receive the total errors = 0

  Receive FIFO overruns total = 0

  Total packets transmitted = 95044

  Total number of bytes sent = 9047702

  Total multicast packets sent = 0

  Total broadcast packets sent = 0

  Total fat transmitted packets = 0

  Total packets transmitted sousdimensionnés = 0

  Total transmit errors = 0

  Total transmit FIFO overruns = 0

  sensor > sh events last 02:00

  evStatus: eventId = 1203360411830836145 = Cisco vendor

  Author:

  login host: ASA2_IPS

  appName: kernel

  appInstanceId:

  time: 2008-02-20 19:01:46 2008/02/20 19:01:46 UTC

  syslogMessage:

  Description: device ge0_1 entered promiscuous mode

  evStatus: eventId = 1203360411830836146 = Cisco vendor

  Author:

  login host: ASA2_IPS

  appName: kernel

  appInstanceId:

  time: 2008-02-20 19:01:53 2008/02/20 19:01:53 UTC

  syslogMessage:

  Description: the promiscuous mode device ge0_1 left

  The left State events and entered promiscuous mode are usually generated when you do a 'package of display' or 'the capture of packets' command on the CLI of the sensor.

  Track order of the package is promiscuity but is independent of promiscuity or inline followed by analysis of the probe engine.

  If you have inline monitoring using the probe analysis engine.

  And still make command package to the cli for your own monitoring promiscuity of those same packets. Here are 2 independent monitors of the same packages.

  If I remember right inline monitored packets always get returned to the ASA (unless expressly denied), which is not promiscuous packets. So check sensors gig0/1 interface statistics and the number of packets for transmission. If receive and transmit accounts are quite close, then packets are monitored by the analytical engine InLine. If the number of transmission is nil or very low then the packets are likely promiscuous monitored.

  With the configuration of your ASA you are correctly configured for online tracking.

  So I don't think that you are investigating inline, and status messages are specific to your start and stop of the command 'package' on the CLI for your own independent viewing packages promiscuity.

• do not get traffic of ASA AIP-SSM-20.

  Hello

  We have Cisco ASA 5510, and we recently added Cisco AIP - SSM. We have configured the sensor and did as well as ASA also but we don't get newspapers in ADM please help me on this.

  Please find attached Sersor Configuration and version of the IPS and ASA module.

  Kind regards

  Nathalie. M

  On the SAA, you need

  access-list aip-acl extended deny ip any any
  
  class-map aip-class
  
  match access-list aip-acl
  
  policy-map global_policy
  
  class aip-class
  
    ips inline fail-open
  
  service-policy global_policy global

  so that it sends traffic to the agreement in principle for inspection.

  I hope it helps.

  PK

• Replication of configuration ASA AIP - SSM

  People,

  The AIP - SSM replicates another AIP - SSM ASA/standby configuration?

  I mean, when I change the configuration on the AIP/SSM assets, will change bring replicated to the other AIP - SSM?

  Thank you

  Yes, unfortunately all the IP addresses are the same. Configuration duplicate automatically 1 unit to another.

  Please kindly marks the message as answered if you have any other question. Thank you...

• Capacity of the crypto ipsec Cisco ASA 9.1 stats system failures

  Hello

  I'm trying to find some performance issues on one ASA centralized and some site VPN settings.  I already address bits of fragmentation and flow control which seeks to solve performance problems, but I came across something that I can't identify to understand what he said.

  I can't seem to find any documentation that explains what triggers the counter for "Capacity of the system failures" on the stats command see the crypto ipsec:

  crypto ipsec sho stats #.

  IPsec statistics
  -----------------------
  The active tunnels: 41
  Previous tunnels: 8999
  Incoming traffic
  Bytes: 8292491846127
  Decompressed bytes: 8292491846127
  Packages: 25115896849
  Packet ignored: 1291637
  Review of chess: 220
  Authentications: 25114592561
  Authentication failures: 0
  Decryptions: 25114592564
  Decryption failures: 0
  TFC packages: 12836
  Fragments of decapsules who need reassembly: 17418535
  Invalid ICMP received errors: 0
  Invalid ICMP received errors: 0
  Outgoing
  Bytes: 37818073925334
  Uncompressed bytes: 37818837785556
  Packages: 38014583887
  Packet ignored: 2413164
  Authentications: 38020189281
  Authentication failures: 0
  Encryption: 38020191839
  Encryption failures: 0
  TFC packets: 0
  Success of fragmentation: 7763651
  Fragmentation before successses: 7763651
  After fragmentation success stories: 0
  Fragmentation failures: 267158
  The failures of previous fragmentation: 267158
  Fragmentation failures after: 0
  Fragments created: 15527302
  PMTUs sent: 267158
  PMTUs rcvd: 185
  Protocol of failures: 0
  Missing chess SA: 255102
  Outages of capacity: 3167258

  Does anyone have knowledge of what this is referring to specifically?

  Cheers, Dale

  Hello

  What is the model of the ASA you have and how many vpn sessions you get on average during peak hours?

  Lack of capacity occurs when it is short of ability of the material or the use...

  Concerning

  Knockaert

• ASA - AIP - SSM design review

  Hello

  If anyone can offer you please, you will enjoy

  We have 2 ASA 5520 with SSM modules in. behind ASA is a CSS load balancer. This load balancer have ssl and ssl certificate installed module. communication from the internet to the VIP loadbalancer is SSL, the SSM module configured to control communication is limited because everythng is encrypted.

  communication between the LB farm and the server is not encryted, but there is no IPS inbetween. can you suggest if someone used the design below

  int 1 (public) - ASA1 - LB 1 interface (dmz) - inside (inside) ASA1 interface where all the web server resides

  Therefore, the traffic is on port 443 to the virtual IP address. Static on ASA 1forwards traffic to its dmz interface where 1 LB, then clear the 1 LB traffic goes to the inside interface where all the serverfarm web resides. by doing so, we can configure the SSM module to monitor the traffic of LB to webserverfarm since its between 2 interfaces of ASA. and also we can have access - list on ASA to allow traffic only between LB and Web servers

  This will be a concern on the performance of the ASA?

  What is a recommended design

  Thank you

  It is a valid design and it should work.

  The ASA will see traffic twice and the interface that is in front of the LB will see traffic entering the lb twice so I'm not sure that it is effective. Please check the amount of traffic will see interfaces to see if the ASAs can manage it.

  Since the LB will be the one actually pulling pages and to talk to your servers, why did you not pass by the ASA, but external users from do not by it, when speaking of LB?

  If you are worried about BACK against LB and you do not have another firewall to use so I assume that it is valid.

  I hope it helps.

  PK

• Cisco ASA cannot create several tunnels at the same address in hand?

  We have several remote sites with Linksys WRVS4400N and Smoothwall firewall/vpn devices.  I need these sites to be able to connect to several tell-contiguous subnets to our main office.  This was done easily with smoothwall and linksys.  You create a separate tunnel for each subnet, and voila, you're done.  However, when I tried this with our ASA newly installed, it won't let me create several tunnels at the same address of the remote peer.  It is a problem because these sites have only a single IP address public static.  Did I miss something or ASA not allow connections to and from multiple subnets form a site with a unique address peer?

  Resembles the limitation on the WRVS4400N as Cisco ASA supports several subnets by tunnel.

  Is there anyway that you can configure a subnet more instead of specific subnets on the ACL?

  For example:

  If you 192.168.0.0/24 and 192.168.1.0/24, instead of having 2 subnets configured, you can combine them into 1 subnet 192.168.0.0/23

• Configure Cisco ASA VPN client

  I did some research and the answers it was supposed to be possible, but no info on how to do it.  I wonder if it is possible to configure a Cisco ASA 5505/10/20 to be a customer to an existing (in this case) cisco vpn client.  The reasons why are complicated (and irrelevant IMO), but basically, I need to be able to make a small network that may be on this vpn rather than on individual computers.

  The vpn client is a Basic IPSec over UDP Cisco VPN to an ASA5505.

  So, how to set up an another ASA to connect to it as if it were a client?

  Hello

  Here is a document from Cisco on the configuration, the easy ASA of VPN server and Client

  Although in this case, they use a PIX firewall as a client.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805c5ad9.shtml

  Here's another site with instructions related to this installation program

  http://www.petenetlive.com/kb/article/0000337.htm

  I imagine that the site of Cisco ASA Configuration Guide documents will also give instructions how to configure it.

  -Jouni

• Routing with Cisco ASA 5520 VPN

  I have installed IPsec vpn remote users in the Cisco ASA 5520 using RADIUS in my main network. Works very well. I have a site to my Cisco ASA5520 tunnels going to other sites, some of the tunnels have Cisco ASA and some have SonicWalls. I wish that my users VPN remote IPSec to be able to navigate in these tunnels is a site to access remote subnets attached to these tunnels. Do I need to use a combination of routing and the ACL? Or can I just use ACL only? Or just use routing only?

  Thank you

  Carlos

  Hello

  The key to set up here is the two ACL of VPN L2L end points that determine the 'interesting' traffic to connect VPN L2L. You will also need to confirm that the connection of the VPN Client is configured so that traffic to the remote sites have sent to the connection of the VPN client. There are also other things that you should check on your ASA plant

  Here most of the things you usually have to confirm

  • Set up 'permit same-security-traffic intra-interface' if it is already present in your configuration
    • This setting will allow connections to form between the hosts that are connected to the same interface on the ASA. In this case, applies because the VPN client users are connected to the interface 'outside' of the ASA and also remote sites are connected to the ASA to "external". If the traffic between the remote VPN Client and VPN L2L sites will be to enter and exit the same interface
  • You will need to check how the customer if configured VPN connection. Split or full Tunnel tunnel
    • If the connection of the VPN Client is configured as Split Tunnel then you need to add all the networks from the remote to the Split Tunnel, so that the connections between the VPN Client is transmitted to the ASA and from there connections VPN L2L
    • If the connection of the VPN Client is configured as full Tunnel, then there no problem that all traffic is transferred to the Client VPN connection all its assets
  • Define the VPN pool in the ACL of VPN L2L
    • You should make sure that the pool network VPN Client is defined in the ACL that define 'interesting' traffic to connect VPN L2L. So, you need to add the pool VPN VPN L2L configurations on the sites of Central America and remote control
  • Configure NAT0 / NAT exempt for remote VPN Client to L2L VPN Site traffic at both ends of the VPN L2L
    • You must ensure that the NAT0 / exempt NAT rules exist for the VPN Client for Remote Site traffic. This will have to be configured on the SAA "outside" interface. Format of configuration varies naturally a bit on the ASA Central his software level.

  These should be the most common things to set up and confirm for traffic to flow between the VPN Client and Remote Sites

  Hope this helps please rate if yes or ask more if necessary.

  -Jouni