Cisco 500 Series, Configuration Manual

Page: 417 / 1140

22-7
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 22 Managing the AIP SSM and CSC SSM
Managing the AIP SSM
The sensor _name argument is the sensor name configured on the AIP SSM. To view the sensors that are
configured on the AIP SSM, enter allocate-ips ? . All available sensors are listed. You can also enter the
show ips command. In the system execution space, the show ips command lists all available sensors; if
you enter it in the context, it shows the sensors you already assigned to the context. If you specify a
sensor name that does not yet exist on the AIP SSM, you get an error, but the
allocate-ips command is
entered as is. Until you create a sensor of that name on the AIP SSM, the context assumes the sensor is
down.
Use the mapped_name argument as an alias for the sensor name that can be used within the context
instead of the actual sensor name. If you do not specify a mapped name, the sensor name is used within
the context. For security purposes, you might not want the context administrator to know which sensors
are being used by the context. Or you might want to genericize the context configuration. For example,
if you want all contexts to use sensors called “sensor1” and “sensor2,” then you can map the “highsec”
and “lowsec” senors to sensor1 and sensor2 in context A, but map the “medsec” and “lowsec” sensors
to sensor1 and sensor2 in context B.
The default keyword sets one sensor per context as the default sensor; if the context configuration does
not specify a sensor name, the context uses this default sensor. You can only configure one default sensor
per context. If you want to change the default sensor, enter the
no allocate-ips sensor_name command
to remove the current default sensor before you allocate a new default sensor. If you do not specify a
sensor as the default, and the context configuration does not include a sensor name, then traffic uses the
default sensor on the AIP SSM.
Step 3 Repeat Step 1 and Step 2 for each context.
Step 4
To configure the context IPS policy, change to the context execution space using the following command:
hostname(config-ctx)# changeto context
context_name
where the context_name argument is the name of the context you want to configure. Change to each
context to configure the IPS security policy as described in “Diverting Traffic to the AIP SSM” section
on page 22-8 .
The following example assigns sensor1 and sensor2 to context A, and sensor1 and sensor3 to context B.
Both contexts map the sensor names to “ips1” and “ips2.” In context A, sensor1 is set as the default
sensor, but in context B, no default is set so the default that is configured on the AIP SSM is used.
hostname(config-ctx)# context A
hostname(config-ctx)# allocate-interface gigabitethernet0/0.100 int1
hostname(config-ctx)# allocate-interface gigabitethernet0/0.102 int2
hostname(config-ctx)# allocate-interface gigabitethernet0/0.110-gigabitethernet0/0.115
int3-int8
hostname(config-ctx)# allocate-ips sensor1 ips1 default
hostname(config-ctx)# allocate-ips sensor2 ips2
hostname(config-ctx)# config-url ftp://user1:passw0rd@10.1.1.1/configlets/test.cfg
hostname(config-ctx)# member gold
hostname(config-ctx)# context sample
hostname(config-ctx)# allocate-interface gigabitethernet0/1.200 int1
hostname(config-ctx)# allocate-interface gigabitethernet0/1.212 int2
hostname(config-ctx)# allocate-interface gigabitethernet0/1.230-gigabitethernet0/1.235
int3-int8
hostname(config-ctx)# allocate-ips sensor1 ips1
hostname(config-ctx)# allocate-ips sensor3 ips2
hostname(config-ctx)# config-url ftp://user1:passw0rd@10.1.1.1/configlets/sample.cfg
hostname(config-ctx)# member silver
hostname(config-ctx)# changeto context A
...