18-20
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter18 Configuring the ASA 5500-X IPS SSP
ASA 5500-X IPS SSP Failover Scenarios
Mod-ips 616> Creating boot.info[ OK ]
Mod-ips 617> Checking for system modifications since last boot[ OK ]
Mod-ips 618> Checking model identification[ OK ]
Mod-ips 619> Model: ASA-5555
Mod-ips 620> Model=ASA-5555
Mod-ips 621> Unable to set speed and duplex for user mode interfaces
Mod-ips 622> interface type 0x8086:0x100e at pci address 0:6.0(0) is currently named eth1
Mod-ips 623> Renaming eth1 --> ma0_0
Mod-ips 624> interface type 0x8086:0x100e at pci address 0:7.0(0) is currently named po0_0
Mod-ips 625> interface type 0x8086:0x100e at pci address 0:5.0(0) is currently named eth0
Mod-ips 626> Renaming eth0 --> sy0_0
Mod-ips 627> Initializing access list
Mod-ips 628> MGMT_INTFC_CIDS_NAME Management0/0
Mod-ips 629> MGMT_INTFC_OS_NAME ma0_0
Mod-ips 630> SYSTEM_PCI_IDS 0x0030,0x0028
Mod-ips 631> Load rebootkom:
Mod-ips 632> root: Starting SSM controlplane
Mod-ips 633> Starting CIDS:
Mod-ips 634> starting pid 1718, tty '/dev/ttyS0': '/sbin/getty -L ttyS0 9600 vt100'
ASA 5500-X IPS SSP Failover Scenarios
The following failover scenarios apply to the ASA 5500-X series in the event of configuration changes,
signature/signature engine updates, service packs, and SensorApp crashes on the ASA 5500-X IPS SSP.
Single ASA in Fail-Open Mode
•
If the ASA is configured in fail-open mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a configuration change or signature/signature engine update,
traffic is passed through the ASA without being inspected.
•
If the ASA is configured in fail-open mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is passed
through the ASA without being inspected.
Single ASA in Fail-Close Mode
•
If the ASA is configured in fail-close mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a configuration change or a signature/signature engine update,
traffic is stopped from passing through the ASA.
•
If the ASA is configured in fail-close mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is stopped
from passing through the ASA.
Two ASAs in Fail-Open Mode
•
If the ASAs are configured in fail-open mode and if the ASA5500-X IPS SSP on the active ASA
experiences a configuration change or a signature/signature engine update, traffic is still passed
through the active ASA without being inspected. Failover is not triggered.
•
If the ASAs are configured in fail-open mode, and if the ASA 5500-X IPS SSP on the active ASA
experiences a SensorApp crash or a service pack upg rade, failover is triggered and traffic passes
through the ASA 5500-X IPS SSP that was previously the standby ASA5500- XIPS SSP.