Cisco 500 Series, Configuration Manual

Page: 419 / 1140

22-9
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 22 Managing the AIP SSM and CSC SSM
Managing the CSC SSM
hostname(config-pmap-c)# ips { inline | promiscuous } { fail-close | fail-open } [ sensor
sensor_name ]
where the class_map_name2 argument is the name of a separate class map on which you want to perform
IPS inspection. See Step 3 for information about the command options. See the “Layer 3/4 Policy Map
Overview” section on page 21-13 for detailed information about how the order of classes matters within
a policy map. Traffic cannot match more than one class map for the same action type; so if you want
network A to go to sensorA, but want all other traffic to go to sensorB, then you need to enter the
class
command for network A before you enter the class command for all traffic; otherwise all traffic
(including network A) will match the first class command, and will be sent to sensorB.
Step 5 To activate the policy map on one or more interfaces, enter the following command:
hostname(config-pmap-c)# service-policy policy_map_name [ global | interface interface_ID ]
hostname
where policy_map_name is the policy map you configured in Step 2 . To apply the policy map to traffic
on all the interfaces, use the global keyword. To apply the policy map to traffic on a specific interface,
use the interface interface_ID option, where interface_ID is the name assigned to the interface with the
nameif command.
Only one global policy is allowed. You can override the global policy on an interface by applying a
service policy to that interface. You can only apply one policy map to each interface.
The following example diverts all IP traffic to the AIP SSM in promiscuous mode, and blocks all IP
traffic if the AIP SSM card fails for any reason:
hostname(config)# access-list IPS permit ip any any
hostname(config)# class-map my-ips-class
hostname(config-cmap)# match access-list IPS
hostname(config-cmap)# policy-map my-ips-policy
hostname(config-pmap)# class my-ips-class
hostname(config-pmap-c)# ips promiscuous fail-close
hostname(config-pmap-c)# service-policy my-ips-policy global
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the AIP SSM in inline mode, and allows all traffic through if the AIP SSM card fails for any reason.
For the my-ips-class traffic, sensor1 is used; for the my-ips-class2 traffic, sensor2 is used.
hostname(config)#
access-list my-ips-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)# access-list my-ips-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)# class-map my-ips-class
hostname(config-cmap)#
match access-list my-ips-acl
hostname(config)# class-map my-ips-class2
hostname(config-cmap)# match access-list my-ips-acl2
hostname(config-cmap)#
policy-map my-ips-policy
hostname(config-pmap)# class my-ips-class
hostname(config-pmap-c)# ips inline fail-open sensor sensor1
hostname(config-pmap)#
class my-ips-class2
hostname(config-pmap-c)# ips inline fail-open sensor sensor2
hostname(config-pmap-c)# service-policy my-ips-policy interface outside
Managing the CSC SSM
This section includes the following topics:
•
About the CSC SSM, page 22-10