Cisco Systems IPS4510K9 manual ASA 5585-X IPS SSP Virtual Sensor Configuration Sequence, 19-5

Chapter 19 Configuring the ASA 5585-X IPS SSP

Creating Virtual Sensors for the ASA 5585-X IPS SSP

The ASA 5585-X IPS SSP Virtual Sensor Configuration Sequence

Follow this sequence to create virtual sensors on the ASA 5585-X IPS SSP, and to assign them to adaptive security appliance contexts:

1.Configure up to four virtual sensors.

2.Assign the ASA 5585-X IPS SSP sensing interface (PortChannel 0/0), to one of the virtual sensors.

3.(Optional) Assign virtual sensors to different contexts on the adaptive security appliance.

4.Use MPF to direct traffic to the targeted virtual sensor.

Creating Virtual Sensors

Note You can create four virtual sensors.

Use the virtual-sensorname command in service analysis engine submode to create virtual sensors on the ASA 5585-X IPS SSP. You assign policies (anomaly detection, event action rules, and signature definition) to the virtual sensor. You can use the default policies, ad0, rules0, or sig0, or you can create new policies.Then you assign the sensing interface, PortChannel 0/0 for the ASA 5500-X IPS SSP, to one virtual sensor.

The following options apply:

•anomaly-detection—Specifies the anomaly detection parameters:

–anomaly-detection-namename—Specifies the name of the anomaly detection policy.

–operational-mode—Specifies the anomaly detection mode (inactive, learn, detect).

Note Anomaly detection is disabled by default. You must enable it to configure or apply an

anomaly detection policy. Enabling anomaly detection results in a decrease in performance.

•description—Provides a description of the virtual sensor.

•event-action-rules—Specifies the name of the event action rules policy.

•signature-definition—Specifies the name of the signature definition policy.

•physical-interfaces—Specifies the name of the physical interface.

•no—Removes an entry or selection.

Creating Virtual Sensors

To create a virtual sensor on the ASA 5585-X IPS SSP, follow these steps:

Step 1 Log in to the CLI using an account with administrator privileges.

Step 2 Enter service analysis mode.

sensor# configure terminal

sensor(config)# service analysis-engine

sensor(config-ana)#

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		19-5