Cisco ASA 5508-X, Configuration Manual

Page: 134 / 428

7-24
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 7 ASA FirePOWER Module
History for the ASA FirePOWER Module
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the ASA FirePOWER module, and allows all traffic through if the module fails for any reason.
hostname(config)# access-list my-sfr-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)#
access-list my-sfr-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)# class-map my-sfr-class
hostname(config-cmap)# match access-list my-sfr-acl
hostname(config)#
class-map my-sfr-class2
hostname(config-cmap)# match access-list my-sfr-acl2
hostname(config-cmap)# policy-map my-sfr-policy
hostname(config-pmap)#
class my-sfr-class
hostname(config-pmap-c)# sfr fail-open
hostname(config-pmap)# class my-sfr-class2
hostname(config-pmap-c)#
sfr fail-open
hostname(config-pmap-c)# service-policy my-sfr-policy interface outside
History for the ASA FirePOWER Module
Feature
Platform
Releases
Description
ASA 5585-X (all models) support for the
matching ASA FirePOWER SSP hardware
module.
ASA 5512-X through ASA 5555-X support for
the ASA FirePOWER software module.
ASA 9.2(2.4)
ASA
FirePOWER
5.3.1
The ASA FirePOWER module supplies next-generation
firewall services, including Next-Generation IPS (NGIPS),
Application Visibility and Control (AVC), URL filtering,
and Advanced Malware Protection (AMP).You can use the
module in single or multiple context mode, and in routed or
transparent mode.
We introduced or modified the following commands:
capture interface asa_dataplane , debug sfr , hw-module
module 1 reload , hw-module module 1 reset , hw-module
module 1 shutdown , session do setup host ip, session do
get-config, session do password-reset, session sfr, sfr,
show asp table classify domain sfr
, show capture , show
conn , show module sfr , show service-policy, sw-module
sfr .
ASA 5506-X support for the ASA
FirePOWER software module, including
support for configuring the module in ASDM ASA 9.3(2)
ASDM 7.3(3)
ASA
FirePOWER
5.4.1
You can run the ASA FirePOWER software module on the
ASA 5506-X. You can manage the module using
FireSIGHT Management Center, or you can use ASDM.
ASA FirePOWER passive monitor-only mode
using traffic redirection interfaces ASA 9.3(2)
ASA
FirePOWER
5.4.1
You can now configure a traffic forwarding interface to send
traffic to the module instead of using a service policy. In this
mode, neither the module nor the ASA affects the traffic.
We fully supported the following command:
traffic-forward sfr monitor-only . You can configure this
in CLI only.