19-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter19 Configuring the ASA 5585-X IPS SSP
Creating Virtual Sensors for the ASA 5585-X IPS SSP
Creating Virtual Sensors for the ASA 5585-X IPS SSP
This section describes how to create virtual sensors on the ASA 5585-X IPS SSP, and contains the
following topics:
•
The ASA 5585-X IPS SSP and Virtualization, page19-4
•
The ASA 5585-X IPS SSP Virtual Sensor Configuration Sequence, page 19-5
•
Creating Virtual Sensors, page 19-5
•
Assigning Virtual Sensors to Adaptive Security Appliance Contexts, page 19-7

The ASA 5585-X IPS SSP and Virtualization

The ASA 5585-X IPS SSP has two interfaces, the management interface (command and control) and the
sensing interface. The command and control interface has an IP address and is used for configuring the
ASA 5585-X IPS SSP. It is used by the ASA5585-X I PS SSP to transmit security and status events to
the IDM or IME. The ASA 5585-X IPS SSP command and control interface is named Management 0/0.
Caution
The ASA 5585-X IPS SSP has four types of ports (console, management, GigabitEthernet, and 10GE).
The console and management ports (on the right front panel of the ASA 5585-X IPS SSP) are co nfigured
and controlled by IPS software. The GigabitEthernet and 10GE ports (on the left front panel of the
ASA 5585-X IPS SSP) are configured and controlled by ASA software rather than IPS software.
However, when you reset or shut down the ASA 5585-X IPS SSP, the GigabitEthernet and 10GE ports
will also link down. You should reset or shut down the ASA 5585-X IPS SSP during scheduled
maintenance windows to minimize the effect of the link down on these ports.
The command and control interface is permanently enabled. It is permanently mapped to a specific
physical interface. You cannot use the command and control interface as either a sensing or alternate
TCP reset interface.
Sensing interfaces are used to analyze traffic for security violations. There is only one sensing interface
on the ASA 5585-X IPS SSP. It is named PortChannel 0/0 and is a backplane interface. All backplane
interfaces have fixed speed, duplex, and state settings. These settings are protected in the default
configuration on all backplane interfaces. You configure the ASA5585-X IPS SSP interface by security
context on the adaptive security appliance. The sensing interface is permanently enabled. When you
create multiple virtual sensors, you must assign the sensing interface to only one virtual sensor. For the
other virtual sensors you do not need to designate an interface.
After you create virtual sensors, you must map them to a security context on the adaptive security
appliance using the allocate-ips command. You can map many security contexts to many virtual sensors.
Note
The allocate-ips command does not apply to single mode. In this mode, the a daptive security appliance
accepts any virtual sensor named in a policy-map command.
The allocate-ips command adds a new entry to the security context database. A warning is issued if the
specified virtual sensor does not exist; however, the configuration is allowed. The configuration is
checked again when the service-policy command is processed. If the virtual sensor is not valid, the
fail-open policy is enforced.