Cisco Systems Assigning Virtual Sensors to a Security Context (ASA 5510 and Higher)

62-15
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter62 Configuring the ASA IPS Module
Configuring the ASA IPS module
Assigning Virtual Sensors to a Security Context (ASA 5510 and Higher)
If the ASA is in multiple context mode, then you can assign one or more IPS virtual sensors to each
context. Then, when you configure the context to send traffic to the ASA IPS module, you can specify a
sensor that is assigned to the context; you cannot specify a sensor that you did not assign to the context.
If you do not assign any sensors to a context, then the default sensor configured on the ASA IPS module
is used. You can assign the same sensor to multiple contexts.
Note You do not need to be in multiple context mode to use virtual sensors; you can be in single mode and use
different sensors for different traffic flows.
Prerequisites
For more information about configuring contexts, see the “Configuring Multiple Contexts” section on
page 11-14.
Detailed Steps
Step1 In the ASDM Device List pane, double-click System under the active device IP address.
Step2 On the Context Management > Security Contexts pane, choose a context that you want to configure, and
click Edit.
The Edit Context dialog box appears. For more information about configuring contexts, see the
“Configuring Multiple Contexts” section on page11-14.
Step3 In the IPS Sensor Allocation area, click Add.
The IPS Sensor Selection dialog box appears.
Step4 From the Sensor Name drop-down list, choose a sensor name from those configured on the ASA IPS
module.
Step5 (Optional) To assign a mapped name to the sensor, enter a value in the Mapped Sensor Name field.
This sensor name can be used within the context instead of the actual sensor name. If you do not specify
a mapped name, the sensor name is used within the context. For security purposes, you might not want
the context administrator to know which sensors are being used by the context. Or you might want to
genericize the context configuration. For example, if you want all contexts to use sensors called
“sensor1” and “sensor2,” then you can map the “highsec” and “lowsec” sensors to sensor1 and sensor2
in context A, but map the “medsec” and “lowsec” sensors to sensor1 and sensor2 in context B.
Step6 Click OK to return to the Edit Context dialog box.
Step7 (Optional) To set one sensor as the default sensor for this context, from the Default Sensor drop-down
list, choose a sensor name.
If you do not specify a sensor name when you configure IPS within the context configuration, the context
uses this default sensor. You can only configure one default sensor per context. If you do not specify a
sensor as the default, and the context configuration does not include a sensor name, then traffic uses the
default sensor on the ASA IPS module.
Step8 Repeat this procedure for each security context.