Cisco Systems Using Virtual Sensors (ASA 5510 and Higher)

62-3
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter62 Configuring the ASA IPS Module
Information About the ASA IPS module
amount of traffic might pass through the ASA before the ASA IPS module can shun it. Figure62-2
shows the ASA IPS module in promiscuous mode. In this example, the ASA IPS module sends a
shun message to the ASA for traffic it identified as a threat.
Figure62-2 ASA IPS module Traffic Flow in the ASA: Promiscuous Mode
Using Virtual Sensors (ASA 5510 and Higher)
The ASA IPS module running IPS software Version 6.0 and later can run multiple virtual sensors, which
means you can configure multiple security policies on the ASA IPS module. You can assign each ASA
security context or single mode ASA to one or more virtual sensors, or you can assign multiple security
contexts to the same virtual sensor. See the IPS documentation for more information about virtual
sensors, including the maximum number of sensors supported.
Figure 62-3 shows one security context paired with one virtual sensor (in inline mode), while two
security contexts share the same virtual sensor.
Figure62-3 Security Contexts and Virtual Sensors
Figure 62-4 shows a single mode ASA paired with multiple virtual sensors (in inline mode); each defined
traffic flow goes to a different sensor.
ASA
Main System
inside
IPS
IPS inspection
outside
VPN
Decryption
Firewall
Policy
Shun
message
251158
Copied Traffic
ASA
Main System
IPS
Sensor
1
Context
1
Context
2
Context
3
Sensor
2
251160