Cisco Systems Configuring the Security Policy on the ASA IPS Module

31-15
Cisco ASA Series Firewall CLI Configuration Guide
Chapter31 Configuring the ASA IPS Module
Configuring the ASA IPS module
Examples
The following example configures VLAN 20 as the IPS management VLAN. Only the host at 10.1.1.30
can access the IPS management IP address. VLAN 20 is assigned to switch port Ethernet 0/0. When you
connect to ASDM on ASA interface 10.1.1.1, ASDM then accesses the IPS on 10.1.1.2.
ciscoasa(config)# interface vlan 1
ciscoasa(config-if)# no allow-ssc-mgmt
ciscoasa(config-if)# interface vlan 20
ciscoasa(config-if)# nameif management
ciscoasa(config-if)# ip address 10.1.1.1 255.255.255.0
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# allow-ssc-mgmt
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# hw-module module 1 ip 10.1.1.2 255.255.255.0 10.1.1.1
ciscoasa(config)# hw-module module 1 allow-ip 10.1.1.30 255.255.255.255
ciscoasa(config)# interface ethernet 0/0
ciscoasa(config-if)# switchport access vlan 20
ciscoasa(config-if)# no shutdown
Configuring the Security Policy on the ASA IPS Module
This section describes how to configure the ASA IPS module application.
Step5 hw-module module 1 ip ip_address netmask
gateway
Example:
ciscoasa# hw-module module 1 ip 10.1.1.2
255.255.255.0 10.1.1.1
Configures the management IP address for the ASA IPS module.
Make sure this address is on the same subnet as the ASA VLAN
IP address. For example, if you assigned 10.1.1.1 to the VLAN for
the ASA, then assign another address on that network, such as
10.1.1.2, for the IPS management address.
Set the gateway to be the ASA IP address for the management
VLAN. By default, this IP address is 192.168.1.1.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Step6 hw-module module 1 allow-ip ip_address
netmask
Example:
ciscoasa# hw-module module 1 allow-ip
10.1.1.30 255.255.255.0
Sets the hosts that are allowed to access the management IP
address.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Command Purpose