Cisco 500 Series, Руководство по настройке

Страница: 414 / 1140

22-4
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 22 Managing the AIP SSM and CSC SSM
Managing the AIP SSM
Figure 22-3 Security Contexts and Virtual Sensors
Figure 22-4 shows a single mode security appliance paired with multiple virtual sensors (in inline
mode); each defined traffic flow goes to a different sensor.
Figure 22-4 Single Mode Security Appliance with Multiple Virtual Sensors
AIP SSM Procedure Overview
Configuring the AIP SSM is a process that includes configuration of the AIP SSM and then configuration
of the ASA 5500 series adaptive security appliance:
1. Session to the AIP SSM from the security appliance. See the “Sessioning to the AIP SSM” section
on page 22-5 .
2.
On the AIP SSM, configure the inspection and protection policy, which determines how to inspect
traffic and what to do when an intrusion is detected. Configure the inspection and protection policy
for each virtual sensor if you want to run the AIP SSM in multiple sensor mode. See the
“Configuring the Security Policy on the AIP SSM” section on page 22-6 .
3. On the ASA 5500 series adaptive security appliance in multiple context mode, specify which IPS
virtual sensors are available for each context (if you configured virtual sensors). See the
“Assigning
Virtual Sensors to Security Contexts” section on page 22-6 .
4.
On the ASA 5500 series adaptive security appliance, identify traffic to divert to the AIP SSM. See
the
“Diverting Traffic to the AIP SSM” section on page 22-8 .
Security Appliance
Main System
AIP SSM
Sensor
1
Context
1
Context
2
Context
3
Sensor
2
191316
Sensor
1
Sensor
2
Sensor
3
Security Appliance
Main System
AIP SSM
Traffic 1
Traffic 2
Traffic 3
191315