18-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter18 Configuring the ASA 5500-X IPS SSP
Creating Virtual Sensors for the ASA 5500-X IPS SSP
Use the virtual-sensor name command in service analysis engine submode to create virtual sensors on
the ASA 5500-X IPS SSP. You assign policies (anomaly detection, event action rules, and signature
definition) to the virtual sensor. You can use the default policies, ad0, rules0, or sig0, or you can create
new policies.Then you assign the sensing interface, PortChannel 0/0 for the ASA 5500-X IPS SSP to
one virtual sensor.
The following options apply:
•
anomaly-detection—Specifies the anomaly detection parameters:
–
anomaly-detection-name name—Specifies the name of the anomaly detection policy.
–
operational-mode—Specifies the anomaly detection mode (inactive, learn, detect).
Note
Anomaly detection is disabled by default. You must enable it to configure or apply an
anomaly detection policy. Enabling anomaly detection results in a decrease in
performance.
•
description—Provides a description of the virtual sensor.
•
event-action-rules—Specifies the name of the event action rules policy.
•
signature-definition—Specifies the name of the signature definition policy.
•
physical-interfaces—Specifies the name of the physical interface.
•
no—Removes an entry or selection.
Creating Virtual Sensors
To create a virtual sensor on the ASA 5500-X IPS SSP, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter service analysis mode.
sensor# configure terminal
sensor(config)# service analysis-engine
sensor(config-ana)#
Step 3
Add a virtual sensor.
sensor(config-ana)# virtual-sensor vs1
sensor(config-ana-vir)#
Step 4
Add a description for this virtual sensor.
sensor(config-ana-vir)# description virtual sensor 1
Step 5
Assign an anomaly detection policy and operational mode to this virtual sensor if you have enabled
anomaly detection. If you do not want to use the default anomaly detection policy, ad0, you must create
a new one using the service anomaly-detection name command, for example, ad1.
sensor(config-ana-vir)# anomaly-detection
sensor(config-ana-vir-ano)# anomaly-detection-name ad0
sensor(config-ana-vir-ano)# operational-mode learn
Step 6
Assign an event action rules policy to this virtual sensor. If you do not want to use the default event action
rules policy, rules0, you must create a new one using the service event-action-rules name command, for
example, rules1
sensor(config-ana-vir-ano)# exit
sensor(config-ana-vir)# event-action-rules rules0