Cisco Systems ASA 5512-X through ASA 5555-X (Software Module)

31-9
Cisco ASA Series Firewall CLI Configuration Guide
Chapter31 Configuring the ASA IPS Module
Configuring the ASA IPS module
If you do not have an inside router
If you have only one inside network, then you cannot also have a separate management network, which
would require an inside router to route between the networks. In this case, you can manage the ASA from
the inside interface instead of the Management 0/0 interface. Because the IPS module is a separate device
from the ASA, you can configure the IPS Management 1/0 address to be on the same network as the
inside interface.
ASA 5512-X through ASA 5555-X (Software Module)
These models run the IPS module as a software module, and the IPS management interface shares the
Management 0/0 interface with the ASA.
If you have an inside router
If you have an inside router, you can route between the Management 0/0 network, which includes both
the ASA and IPS management IP addresses, and the inside network. Be sure to also add a route on the
ASA to reach the Management network through the inside router.
Internet
Layer 2
Switch ASA
Inside
IPS Management 1/0
ASA Management 0/0 not used
Outside
IPS
IPS Default Gateway
Management PC
Proxy or DNS Server
(for example)
334660
ASA 5545-X IPS Management 0/0
Default IP: 192.168.1.2
ASA Management 0/0
Default IP: 192.168.1.1
334665
Internet
Management PC
Proxy or DNS Server (for example)
Router
ASA
Management 0/0
Outside
IPS
Management
Inside
IPS Default
Gateway
ASA gateway for Management
334667