The ASA IPS configuration

Similar Questions

• the ASA 5505 configuration

  Hey guys

  I have a server that accepts traffic on a port within my network and external clients need to access this server. the nat and accesslist works well, but it is a matter of wait time and connection failed... Note that without the client server asa directly works fine... and note also that the traffic is encrypted (ssl)... are there additional provisions that I have to configure? y is it expire? Packet Capture see traffic from the outside to reach inside the interface but no response from the inside to the outside...

  I don't have that only one access list reloads the traffic from the outside to the server and a nat rule.

  advice needed...

  Thank you

  Hello

  So from what I understand

  "inside the xxx.114 interface the default route on the server is xxx.1 which is one interface on another asa.

  This means that the default route on the server is an another ASA. It won't work unless you apply TCP statebypass.

  ASA is a statefull firewall. This means for the TCP IP, always see two way traffic. If SYN crosses an ASA should see SYN/ACK back. If an ASA did not syn and sees syn/ack due to asymmetric routing, is wrong in the wok.

  Change the default route in the same ASA server or configure TCP statebypass (which is not recommended however).

  Thank you

• Access to the ASA 5515 IPS administration

  Hello!

  I can not access the ASA IPS module.

  I try to ASDM. Configuration-> IPS. I type user name and password, see following message: "error connecting to the sensor. Error loading sensor.

  Could you please help me fix my config?

  I have the topology of the network like this

  http://www.Cisco.com/image/gif/paws/113690/IPS-config-mod-01.gif

  My config

  KR - ASA # sh run concert int 0/5

  !

  interface GigabitEthernet0/5

  nameif inside

  security-level 100

  IP 172.33.1.253 255.255.255.0 watch 172.33.1.254

  !

  interface Management0/0

  management only

  No nameif

  security-level 0

  no ip address

  !

  KR - ASA # sh details ips module

  App name: IPS

  App status. : to the top

  App Status / / Desc: Normal operation

  App version: 4,0000 E4

  Flight status data: to the top

  Status: to the top

  License: IPS active Module perpetual

  Mgmt IP addr: 172.33.1.251

  MGMT network mask: 255.255.255.0

  Mgmt gateway: 172.33.1.253

  MGMT access list: 172.33.1.0/24

  MGMT access list: 172.34.1.0/24

  Web to MGMT ports: 443

  Mgmt TLS enabled: true

  !

  KR - ASA # ping 172.33.1.251

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 172.33.1.251, wait time is 2 seconds:

  !!!!!

  Success rate is 100 per cent (5/5), round-trip min/avg/max = 10/10/10 ms

  !

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  !

  Thank you!

  Hi Vladimir,.

  Yups, this is an issue that is seen. Downgrade of Java should solve the problem. If this is not the case, turn on java debugging logs and paste those here:

  Go to control panel-> java right click-> Open-> Advanced-> check all the boxes that appear under debugging and click the radio button to see the console

  Rerun the IDM in browser and collect data in the java console window and paste it here.

  -

  Kind regards

  Sourav Kakkar

• How to configure ASA IPS, which is connected to the Internet

  Hello guys,.

  I am a beginner in the Concept ASA IPS and that my company HAS an ASA 5520.

  Currently, ASA has been connected to the router connected ISP and internet acting as a firewall to control the traffic which

  is integrated with Websense URL filtering.

  Can you please let me know what all should we expected to configure IPS in this scenario, and what is the IPS feature.

  What is the main function of the IPS?

  Grateful to your messages.

  Kind regards

  KA.

  KA;

  The main function of the AIP - SSM in your ASA 5520 is to perform deep inspection packet and signature matching to detect traffic potential of achievement within your network.  If this traffic is detected, the AIP - SSM denying traffic to cross your ASA.  Here is a link to a brief overview of the product:

  http://www.Cisco.com/go/aipssm

  First, you must configure the ASA to divert traffic to the AIP - SSM for inspection, it is shown here:

  http://www.Cisco.com/en/us/docs/security/IPS/7.0/Configuration/Guide/CLI/cli_ssm.html

  So, you want to make sure that background basket interface (GigabitEthernet0/1) is added to a virtual sensor on the AIP - SSM for allow the inspections to occur.

  You want to make sure that the signature on the AIP - SSM definitions are up-to-date.  This ensures the most accurate protection from the perspective of the AIP - SSM.  This will require an active license be installed on the AIP - SSM.

  Then, you most likely want to monitor events generated by the AIP - SSM.  To do this, Cisco offers a free entry-level called IPS Manager Express (IME) solution.  You can learn more and download IME here:

  http://www.Cisco.com/go/IME

  You will want to monitor EMI to learn that the potential risks of security in network traffic crossing your infrastructure.  When you experience events for which you would like to understand better, you can site IntelliShield visist Cisco for further investigation:

  http://www.Cisco.com/security

  Details here, can also be extended within the IME event view.

  Use of an IPS will be a continuous monitor and learn phase in order to ensure that you are aware of traffic expected and unexpected, and that the appropriate response can be applied.  This is something which is different in each environment, so it is not a simple white paper on how to perform these actions.

  Scott

• IPS modules in the ASA config for active/passive failover

  Hey guys,.

  We have two ASA in a situation of active/passive failover each with a module AIP-SSM-20 IPS.

  These modules are intended to synchronize their configs like the ASA do? Alternatively, they each have a separate entity and each need to be configured separately?

  Thanks for any help!

  Each will have their own IP address, and each must be configured separately.

  They will not communicate with each other and share no configuration.

  You will need to make sure the config is changed in one of the other.

  Monitoring station pull events from two sensors.

  The SSMs rely on the SAA for the TCP state tracking so they will work very well in a design of failover ASA.

• Check the IPS configuration

  I am very new on the front of Cisco IPS and have configured an ASA 5510 with the SSM-10 IPS module.  We have a compatible interface with multiple VLANs on this interface.  I installed the IPS, to the best of my ability, and I think it's okay as inline doesn't open in a configuration of active / standby asa.  Is it possible to check that the traffic flows properly to this IPS module?  Also, I've mentioned on the Setup it of because this version of the IPS, if I understand correctly, will not allow pairs VLAN, then when I put the policy to inspect all traffic, this traffic inspected between all the VLANS.  Another mystery, this is when I discovered my IPS interfaces (management and is not) that is not configured as management shows no matched.

  I know it of a lot, so let me summarize:

  -How can I check that my setup works as intended where all traffic between all them VLAN is inspected.

  -Why my interface managers showing 'matched '.

  -Looking through all of the Cisco documentation, I noticed the mention of the "contexts"; I don't see any reference to these contexts within the IDM.  It's just for my knowledge, but may be necessary for installation... I do not know.

  Thank you!

  Hello Mote, heat

  With regard to your questions:

  -How can I check that my setup works as intended where all traffic between all them VLAN is inspected?

  Since you're using an IPS module, traffic that matches the class configured on the SAA is under inspection, you can configure a capture on the dataplane Interface (the Interface used to send traffic to the ASA to IPS) using this command:

  capture ips int asa_dataplane buffer 15000000

  Check capture using the:

  See the FPS capture

  The output should display the packets from for each VLAN.

  -Why my interface managers showing 'matched '?

  

  Modules ASA IPS (ASA 5500 AIP SSM, ASA IPS 5500-X SSP and ASA IPS SSP 5585-X) do not support pairs VLAN inline.

  You can associate a VLAN in pairs on a physical interface. This is known as pair mode for the VLAN inline. Packets received on one of VLAN matched are analyzed and then forwarded to another VLAN in the pair. Because the module has only a detection interface, this is why it is shown as Unpaired.

  Literature speaks of "security contexts. You can partition an ASA unique in several virtual devices, called security contexts. Each context is an independent device, with its own security policy, interfaces, and administrators. Several contexts resemble have several stand-alone devices. Many features are supported in multiple context mode, including the routing tables, features of firewall, IPS, and management.

  Please rate the answer if you find it useful.

• ASA 5510 Configuration. How to set up 2 outside the interface.

  Hello

  I have Cisco ASA 5510 and the desktop, I want to create a new route to another (external) router to my ISP.

  The workstation I can Ping ASA E0/2 interface but I cannot ping the router ISP B inside and outside of the interface.

  I based my setup on the existing configuration. which so far is working

  interface Ethernet0/0
  Outside of the interface description
  nameif outside
  security-level 0
  IP 122.55.71.138 address 255.255.255.2
  !
  interface Ethernet0/1
  Inside the interface description
  nameif inside
  security-level 100
  IP 10.34.63.252 255.255.240.0
  !
  interface Ethernet0/2
  Outside of the interface description
  nameif outside
  security-level 0
  IP 121.97.64.178 255.255.255.240
  !

  Global 1 interface (outside)

  global (outside) 2 interface (I created this for E0/2)
  NAT (inside) 0 access-list sheep

  NAT (inside) 1 10.34.48.11 255.255.255.255 (work: router ISP inside and outside interface E0/0)

  NAT (inside) 2 10.34.48.32 255.255.255.255 (work: E0/2 router ISP on the inside interface only but cant outside ping).

  Route outside 0.0.0.0 0.0.0.0 122.55.71.139 1 (work)

  Route outside 10.34.48.32 255.255.255.255 121.97.64.179 1 (the new Road Test)

  Router ISP, that a job can ping and I can access the internet

  interface FastEthernet0/0
  Description Connection to ASA5510
  IP 122.55.71.139 255.255.255.248
  no ip redirection
  no ip proxy-arp
  IP nat inside
  automatic duplex
  automatic speed
  !
  the interface S0/0
  IP 111.54.29.122 255.255.255.252
  no ip redirection
  no ip proxy-arp
  NAT outside IP
  !
  IP nat inside source static 122.55.71.139 111.54.29.122
  IP http server
  IP classless
  IP route 0.0.0.0 0.0.0.0 Serial0/0

  FAI 2

  interface FastEthernet0/0 (SAA can ping this interface)
  Description Connection to ASA5510
  IP 121.97.64.179 255.255.255.248
  no ip redirection
  no ip proxy-arp
  IP nat inside
  automatic duplex
  automatic speed
  !
  interface E0/0 (ASA Can not ping this interface)
  IP 121.97.69.122 255.255.255.252
  no ip redirection
  no ip proxy-arp
  NAT outside IP
  !
  IP nat inside source static 121.97.64.179 121.97.69.122
  IP http server
  IP classless
  IP route 0.0.0.0 0.0.0.0 E0/0

  CABLES

  ASA to router ISP B (straight cable)

  Router ISP in the UDI (straight cable)

  Hope you could give some advice and the solution for this kind of problem please

  Hello

  Are you able to ping the router IP of the interface of the device of the ASA? If so, try a trace of package on the device of the SAA for traffic to the IP address of the router.

  Thank you and best regards,

  Maryse Amrodia

• The ASA for FW and IPS options with high availability

  Question 1:

  -----------

  I'm looking for IPS solution for the customer and the verification of the ASA next part number;

  ASA5540-AIP20-K9

  (ASA 5540 appliance w / AIP-SSM-20, SW, HA, 4GE + 1FE, 3DES/AES)

  What does AP mean here - what software?

  In this case you have to buy a second unit (at the same price) for the recovery of?

  (I wondered if ASA has also a cost - efficient as PIX failover solution-discounted price for the unit of failover).

  If I choose the ASA VPN edition is it possible to add IPS inside module?

  Hello

  Q: what does AP means here - what software? In this case you have to buy a second unit (at the same price) for the recovery of?

  The "ASA5540-AIP20-K9" is only for 1 unit of ASA, with function of software HA (active/active, active / standby). You can add/buy another unit to achieve HA/recundancy.

  I think that the price of a unit all them is always the same, ASA has no unit to voluntarily make the function FO.

  Q: if I choose the ASA VPN edition is it possible to add IPS inside module?

  Large malicious Intrusion Prevention & mitigation program is included, as mentioned in the 'picture' 3 Security of the network to the VPN gateway"in:

  http://www.Cisco.com/en/us/products/ps6120/products_data_sheet0900aecd80402e3f.html

  Rgds,

  AK

• Configure the ASa 5505 of remote site by using ASDM

  I would like to be able to administer the ASA 5505 from another site, which is connected via a LAN of Ipsec site-to-site.

  How to activate this feature?

  Hello

  You can remotely administer an ASA using the public IP address (via the Internet), or through the tunnel to the private IP address.

  You can reach the private IP address by activating the command:

  management-access inside

  You can access the ASA by IP address private via CLI or GUI.

  Federico.

• ASA ips feature

  I want to ask you what the works of IPS on ASAs functionality.

  There all the signatures, or it is limited?

  Perfect me if Iam wrong if I say that I needed module AIM for ips work on the asa. If Iam right, so why AIM has only 1 ethernet interface. This means that I am not follow 1 vlan?

  Thank you very much.

  The ASA-SSM-AIP-10 or ASA-SSM-AIP-20 according to the ASA modules is required for full monitoring of IPS features. The IPS on the MSS software is the same as for devices and other modules IPS. It uses the same software and signature updates. (Except for the image of the main system which has a few extra things to allow installation on the SSM)

  Without the ASA-SSM-AIP, the Software ASA itself has a set of very limited signatures that can be monitored. The signatures set is the same as in the previous version of the Pix Firewall.

  As for the single port on the ASA - SSM. This port is not a monitoring port. The port is the port command and control and has an IP address so that you can telnet, ssh or web browse to the sensor, so you can manage. The real follow-up is done on an internal interface connected inside firewall basket. The ASA can be configured through its policy to send packets through the SSM for the analysis of the IPS. Politics on the SAA can be configured for the IPS to monitor packets histocompatibility or inline.

  The SAA can be configured to send all or part of the packets through the firewall to monitor by the IPS of code that runs on the MSS.

  Since the external port is not a monitoring port that DFS may not be configured to control packets that do not go through the ASA. Packets must pass through the ASA ASA copy these packages through internal backplane to the SSM for analysis.

• ASA at the ASA L2L VPN Firewall

  Hi experts,

  I currently have problems establishing a VPN site-to-site easy. It's my first time at this meeting and I am pulling my hair out for this issue.

  Currently, the installation program below is a typical topology (using ASDM):

  An ASA IP (1.1.1.2) of the site <-->(ISP) <-->Site B (ASA IP 2.2.2.2)

  All ASA IPs are the external interface connecting directly to their respective suppliers. Site has existing VPN tunnels to other networks, but Site B is a new network configuration (one can imagine Site A as a hub and the rest are rays). Site B outside interface opened ports IP 50 ESP, UDP 500 and UDP 4500 on the interface of all sources to connect to the external interface (besides us has allowed all the IP protocol for the external interface for troubleshooting). However, we have issues that phase 1 upward. We have carefully matched and double checked IKEv1 all the settings are correct and the same for the two parties, including the PSK. However Site A can ping IP of the Site B and Site B is not able to ping to the Site A IP.

  We also checked with our Internet service providers and they confirmed that they do not block 3 ports we need for the VPN. Is there more ideas or points that we missed?

  Oh, activation of debugging are not returned all the papers, but will help generate some 'interesting' traffic such as internal ping subnet of Site A of the Site B?

  Hello

  Instead of launching the plotter of the interface IP packets use all other inside IP, I see a failure of ifc interface.

  Also is it possible for you to take the UDP 500 captures on the external interfaces on the SAA?

  This would answer a lot of questions.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• License FireSIGHT - ASA IPS

  Hello

  I currently installs a virtual appliance of FireSIGHT to manage installed with fire services ASA 2.

  My Defense Center is an appropriate license, using the key PAK I got.

  I bought 2 IPS for two of the ASA subscription licenses.

  I have configured the Manager on both devices of sourcefire and added to the centre of defence.

  Now, my problem is: I can't attribute any IPS policy because there seems to be no licenses installed on the domain controller to be applied to devices...

  My question is: what I have to buy additional licenses for the domain controller for the IPS features (Protection) or do I missed something here? :-)

  Thank you very much

  Kind regards

  Hello

  As Marvin commented, you will have a license CTRL "ASA5525-CTRL-ICA" accompanying the device through a certificate of claim. On the certificate, you should see a number PAK and steps to save to get the license. Please follow these.

  If you have purchased a = L - ASA5525 - TA - LIC, then that gives you the right to obtain updates to signature for CONTROL-PROTECT features. There is no PAK or license for this PID.

  -DD

• New deployment with the ASA and AIP - SSM module

  Hi guys and girls,

  I think to deploy an ASA with IPS module AIP - SSM to my perimeter. I'm going to use / * Style Definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;} Cisco IPS Manager Express (IME) to monitor the IP addresses to monitor the ASA. I have no plans on deploying a device IDS.

  Question: The IME is designed to send notices to the subject of threats? What are some of the configurations in your network? (Just prick with the last question.)

  THX...

  IME is designed only for IPS monitor (whether it be IPS appliance, module AIP - SSM on ASA or other module IPS). IME is not able on the control of ASA.

  EMI can provide advice by email about events which are fires on the IPS, while the IPS itself cannot. EMI may also keep all the events triggered by the IPS, while SPI buffer is small enough, that so if you have huge demonstrations, the buffer gets replaced pretty quickly.

  Here is more information about IME, if you are interested:

  http://www.Cisco.com/en/us/products/ps9610/index.html

• Cisco ASA IPS with enforcement

  Hi all

  I don't know if this is the best place to connect to this application, because it comes to ASA and convenient best IPS.

  In any case, I was wondering what the best approach is to integrate a Cisco IPS GOAL module in an existing configuration of Cisco ASA, which uses the default application in the world control - i.e.

  ---------------------------

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  etc etc.

  global service-policy global_policy

  ---------------------------

  I was keen to inspect all traffic that was OK coming from our Web-based interface in our environment, while I was trying to do something like:

  ---------------------------

  class-map ips

  corresponds to the list of internet access

  !

  ips policy-map

  class ips

  IPS inline fail-closed

  !

  global service-policy global_policy

  service-policy ips outside interface

  ---------------------------

  This configuration would allow inspection of the demand for traffic going from inside to outside, but to redirect traffic from outside within the IPS?

  Thank you

  As for the configuration. It should inspect traffic in both directions as apply you it globally, and the map-IPS policy, it would redirect internet traffic to the inside network.

• In ASA IPS module allows you to scan 2 interfaces?

  I'm trying to figure if/how configure the ASA-SSM-20 for scan management/monitor interface and backplane (try to save money and buy not dedicated IPS/IDS for internal network). I'm under IPS v7.0 (8) E4 with v6.4 ASDM. I would use the management port to send traffic split of my Nexus 5548.

  Thank you!

  This feature is not supported at this time.

  Rafael