Cisco Systems IPS4510K9 ASA 5500-X IPS SSP and Bypass Mode, Configure MPF for each context, 18-9

Chapter 18 Configuring the ASA 5500-X IPS SSP

The ASA 5500-X IPS SSP and Bypass Mode

Step 7 Configure MPF for each context.

Note The following example shows context 3 (c3).

asa(config)# context c3 asa/c3(config)# class-map any asa/c3(config-cmap)# match access-list any asa/c3(config-cmap)# exit asa/c3(config)# policy-map ips_out asa/c3(config-pmap)# class any

asa/c3(config-pmap-c)#ips promiscuous fail-close sensor c3vs1 asa/c3(config-pmap-c)#policy-map ips_in asa/c3(config-pmap)#class any

asa/c3(config-pmap-c)#ips inline fail-open sensor c3vs0 asa/c3(config-pmap-c)#service-policy ips_out interface outside asa/c3(config)# service-policy ips_in interface inside asa/c3(config)#

Step 8	Confirm the configuration.
	asa/c3(config)# exit
	asa(config)# show ips detail
	Sensor Name	Sensor ID	Allocated To	Mapped Name
	-----------	---------	------------	-----------
	vs0	1	admin	adminvs0
			c3	c3vs0
	vs1	2	c2	c2vs1
			c3	c3vs1
	asa(config)#

The ASA 5500-X IPS SSP and Bypass Mode

The ASA 5500-X IPS SSP does not support bypass mode. The adaptive security appliance will either fail open, fail close, or fail over depending on the configuration of the adaptive security appliance and the type of activity being done on the ASA 5500-X IPS SSP.

The SensorApp Fails

The following occurs when the SensorApp fails:

•If the adaptive security appliance is configured for failover, then the adaptive security appliance fails over.

•If the adaptive security appliance is not configured for failover or failover is not possible:

–If set to fail-open, the adaptive security appliance passes traffic without sending it to the ASA IPS module.

–If set to fail-close, the adaptive security appliance stops passing traffic until the ASA IPS module is restarted.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		18-9