Cisco Systems ASA 5500 manual Checking SSM Status, 19-13

Page 13

Chapter 19 Managing the AIP SSM and CSC SSM

Checking SSM Status

Example 19-1is based on the network shown in Figure 19-3. It creates two service policies. The first policy, csc_out_policy, is applied to the inside interface and uses the csc_out access list to ensure that all outbound requests for FTP and POP3 are scanned. The csc_out access list also ensures that HTTP connections from inside to networks on the outside interface are scanned but it includes a deny ACE to exclude HTTP connections from inside to servers on the DMZ network.

The second policy, csc_in_policy, is applied to the outside interface and uses the csc_in access list to ensure that requests for SMTP and HTTP originating on the outside interface and destined for the DMZ network are scanned by the CSC SSM. Scanning HTTP requests protects the web server from HTTP file uploads.

Example 19-1 Service Policies for a Common CSC SSM Scanning Scenario

hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 21

hostname(config)# access-list csc_out deny tcp 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0 eq 80 hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 80 hostname(config)# access-list csc_out permit tcp 192.168.10.0 255.255.255.0 any eq 110

hostname(config)# class-map csc_outbound_class hostname(config-cmap)#match access-list csc_out

hostname(config)# policy-map csc_out_policy hostname(config-pmap)#class csc_outbound_class hostname(config-pmap-c)#csc fail-close

hostname(config)# service-policy csc_out_policy interface inside

hostname(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 25 hostname(config)# access-list csc_in permit tcp any 192.168.20.0 255.255.255.0 eq 80

hostname(config)# class-map csc_inbound_class hostname(config-cmap)#match access-list csc_in

hostname(config)# policy-map csc_in_policy hostname(config-pmap)#class csc_inbound_class hostname(config-pmap-c)#csc fail-close

hostname(config)# service-policy csc_in_policy interface outside

Note FTP inspection must be enabled for CSC SSM to scan files transferred by FTP. FTP inspection is enabled by default.

Checking SSM Status

To check the status of an SSM, use the show module command.

The follow example output is from an adaptive security appliance with a CSC SSM installed. The Status field indicates the operational status of the SSM. An SSM operating normally has a status of “Up” in the output of the show module command. While the adaptive security appliance transfers an application image to the SSM, the Status field in the output reads “Recover”. For more information about possible statuses, see the entry for the show module command in the Cisco Security Appliance Command Reference.

 

 

Cisco Security Appliance Command Line Configuration Guide

 

 

 

 

 

 

OL-8629-01

 

 

19-13

 

 

 

 

 

Page 12 Page 14
Image 13
Page 12 Page 14
Contents About the AIP SSM Managing the AIP SSM19-1 Diverting Traffic to the AIP SSM Getting Started with the AIP SSM19-2 19-3 19-4 Sessioning to the AIP SSM and Running SetupAbout the CSC SSM Managing the CSC SSM19-5 Flow of Scanned Traffic with CSC SSM 19-619-7 Getting Started with the CSC SSM19-8 19-9 Determining What Traffic to Scan19-10 Common Network Configuration for CSC SSM ScanningDiverting Traffic to the CSC SSM Limiting Connections Through the CSC SSM19-11 19-12 19-13 Checking SSM Status19-14 Transferring an Image onto an SSM19-15 19-16
Related manuals
Manual 49 pages 36.1 Kb Manual 144 pages 23.87 Kb Manual 16 pages 48.09 Kb

ASA 5500 specifications

Cisco Systems ASA 5500 is a robust security appliance designed to provide advanced network security and protection against both internal and external threats. Ideal for organizations of various sizes, the ASA 5500 series offers a wide range of features that combine firewall capabilities with intrusion prevention, VPN support, and application control, among others.

One of the key features of the ASA 5500 is its stateful firewall technology. This allows the device to monitor active connections and enforce security policies based on the state of the traffic. By maintaining the context of network sessions, the firewall can make informed decisions on whether to allow or deny traffic based on established rules.

In addition to traditional firewall functionalities, the ASA 5500 series integrates advanced intrusion prevention capabilities. By analyzing traffic patterns and identifying known threats, the IPS functionality helps organizations defend against a variety of malicious activities, such as DDoS attacks, malware, and unauthorized access attempts. The ASA 5500 continuously updates its threat intelligence through Cisco's global threat database, enhancing its ability to detect emerging threats in real-time.

Virtual Private Network (VPN) support is another significant aspect of the ASA 5500 series. The device offers secure, encrypted connections for remote users and branch offices, ensuring safe access to corporate resources over the Internet. It supports both IPsec and SSL VPN protocols, allowing organizations to choose the best option for their specific needs. This capability is crucial for businesses that require a secure environment for remote work.

The ASA 5500 series also features extensive application control and visibility tools. These tools enable organizations to manage and control the applications running on their network, ensuring that only authorized applications can communicate through the firewall. This level of control helps to mitigate risks associated with unauthorized applications, which can lead to data breaches or reduced productivity.

Moreover, the ASA 5500 is designed with high availability and scalability in mind. Its clustering support ensures that multiple units can work together to provide redundancy and load balancing, enhancing both performance and reliability. This characteristic is especially important for organizations looking to maintain continuous operation during traffic spikes or hardware failures.

In summary, Cisco Systems ASA 5500 is an all-in-one security solution that combines stateful firewall protection, intrusion prevention, VPN capabilities, and application control. With its robust feature set and focus on security, it is well-suited for organizations seeking to protect their networks from an ever-evolving landscape of cyber threats. Whether for small businesses or large enterprises, the ASA 5500 provides the necessary tools to create a secure networking environment.
Top Page Image Contents