![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_186241502.webp)
1-26
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA IPS Module
Configuration Examples for the ASA IPS module
Mod License Name License Status Time Remaining
--- ----------------- --------------- ---------------
ips IPS Module Enabled 7 days
Configuration Examples for the ASA IPS module
The following example diverts all IP traffic to the ASA IPS module in promiscuous mode, and blocks
all IP traffic if the ASA IPS module card fails for any reason:
hostname(config)#
access-list IPS permit ip any any
hostname(config)#
class-map my-ips-class
hostname(config-cmap)#
match access-list IPS
hostname(config-cmap)#
policy-map my-ips-policy
hostname(config-pmap)#
class my-ips-class
hostname(config-pmap-c)#
ips promiscuous fail-close
hostname(config-pmap-c)#
service-policy my-ips-policy global
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the AIP SSM in inline mode, and allows all traffic through if the AIP SSM fails for any reason. For
the my-ips-class traffic, sensor1 is used; for the my-ips-class2 traffic, sensor2 is used.
hostname(config)#
access-list my-ips-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)#
access-list my-ips-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)#
class-map my-ips-class
hostname(config-cmap)#
match access-list my-ips-acl
hostname(config)#
class-map my-ips-class2
hostname(config-cmap)#
match access-list my-ips-acl2
hostname(config-cmap)#
policy-map my-ips-policy
hostname(config-pmap)#
class my-ips-class
hostname(config-pmap-c)#
ips inline fail-open sensor sensor1
hostname(config-pmap)#
class my-ips-class2
hostname(config-pmap-c)#
ips inline fail-open sensor sensor2
hostname(config-pmap-c)#
service-policy my-ips-policy interface outside
Feature History for the ASA IPS module
lists each feature change and the platform release in which it was implemented.
Table 1-2
Feature History for the ASA IPS module
Feature Name
Platform
Releases
Feature Information
AIP SSM
7.0(1)
We introduced support for the AIP SSM for the ASA 5510,
5520, and 5540.
The following command was introduced:
ips
.
Virtual sensors (ASA 5510 and higher)
8.0(2)
Virtual sensor support was introduced. Virtual sensors let
you configure multiple security policies on the ASA IPS
module.
The following command was introduced:
allocate-ips
.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......