Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1502 / 2164

1-26
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA IPS Module
Configuration Examples for the ASA IPS module
Mod License Name License Status Time Remaining
--- ----------------- --------------- ---------------
ips IPS Module Enabled 7 days
Configuration Examples for the ASA IPS module
The following example diverts all IP traffic to the ASA IPS module in promiscuous mode, and blocks
all IP traffic if the ASA IPS module card fails for any reason:
hostname(config)# access-list IPS permit ip any any
hostname(config)# class-map my-ips-class
hostname(config-cmap)#
match access-list IPS
hostname(config-cmap)# policy-map my-ips-policy
hostname(config-pmap)# class my-ips-class
hostname(config-pmap-c)#
ips promiscuous fail-close
hostname(config-pmap-c)# service-policy my-ips-policy global
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the AIP SSM in inline mode, and allows all traffic through if the AIP SSM fails for any reason. For
the my-ips-class traffic, sensor1 is used; for the my-ips-class2 traffic, sensor2 is used.
hostname(config)# access-list my-ips-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)# access-list my-ips-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)# class-map my-ips-class
hostname(config-cmap)# match access-list my-ips-acl
hostname(config)# class-map my-ips-class2
hostname(config-cmap)# match access-list my-ips-acl2
hostname(config-cmap)# policy-map my-ips-policy
hostname(config-pmap)# class my-ips-class
hostname(config-pmap-c)# ips inline fail-open sensor sensor1
hostname(config-pmap)# class my-ips-class2
hostname(config-pmap-c)# ips inline fail-open sensor sensor2
hostname(config-pmap-c)# service-policy my-ips-policy interface outside
Feature History for the ASA IPS module
Table 1-2 lists each feature change and the platform release in which it was implemented.
Table 1-2 Feature History for the ASA IPS module
Feature Name
Platform
Releases
Feature Information
AIP SSM 7.0(1) We introduced support for the AIP SSM for the ASA 5510,
5520, and 5540.
The following command was introduced: ips .
Virtual sensors (ASA 5510 and higher) 8.0(2) Virtual sensor support was introduced. Virtual sensors let
you configure multiple security policies on the ASA IPS
module.
The following command was introduced: allocate-ips .