Cisco Systems IPS4510K9 The ASA 5500-X IPS SSP and Bypass Mode

18-9
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter18 Configuring the ASA 5500-X IPS SSP
The ASA 5500-X IPS SSP and Bypass Mode
Step 7 Configure MPF for each context.
Note The following example shows context 3 (c3).
asa(config)# context c3
asa/c3(config)# class-map any
asa/c3(config-cmap)# match access-list any
asa/c3(config-cmap)# exit
asa/c3(config)# policy-map ips_out
asa/c3(config-pmap)# class any
asa/c3(config-pmap-c)# ips promiscuous fail-close sensor c3vs1
asa/c3(config-pmap-c)# policy-map ips_in
asa/c3(config-pmap)# class any
asa/c3(config-pmap-c)# ips inline fail-open sensor c3vs0
asa/c3(config-pmap-c)# service-policy ips_out interface outside
asa/c3(config)# service-policy ips_in interface inside
asa/c3(config)#
Step 8 Confirm the configuration.
asa/c3(config)# exit
asa(config)# show ips detail
Sensor Name Sensor ID Allocated To Mapped Name
----------- --------- ------------ -----------
vs0 1 admin adminvs0
c3 c3vs0
vs1 2 c2 c2vs1
c3 c3vs1
asa(config)#
The ASA 5500-X IPS SSP and Bypass Mode
The ASA 5500-X IPS SSP does not support bypass mode. The adaptive security appliance will either
fail open, fail close, or fail over depending on the configuration of the adaptive security appliance and
the type of activity being done on the ASA 5500-X IPS SSP.
The SensorApp Fails
The following occurs when the SensorApp fails:
• If the adaptive security appliance is configured for failover, then the adaptive security appliance fails
over.
• If the adaptive security appliance is not configured for failover or failover is not possible:
– If set to fail-open, the adaptive security appliance passes traffic without sending it to the
ASA IPS module.
– If set to fail-close, the adaptive security appliance stops passing traffic until the ASAIPS
module is restarted.