Cisco Systems IPS4510K9 manual Assign virtual sensors to the security contexts, 19-9

Chapter 19 Configuring the ASA 5585-X IPS SSP

Creating Virtual Sensors for the ASA 5585-X IPS SSP

asa(config-ctx)# all asa(config-ctx)# allocate-inasa(config-ctx)# allocate-interface g0/2 asa(config-ctx)# allocate-interface g0/3 asa(config-ctx)# config-url disk0:/c3.cfg

WARNING: Could not fetch the URL disk0:/c3.cfg

INFO: Creating context with default config asa(config-ctx)#

Step 6 Assign virtual sensors to the security contexts.

asa(config)# context admin asa(config-ctx)#allocate-ips vs0 adminvs0 asa(config-ctx)#exit

asa(config)# context c2 asa(config-ctx)# allocate-ips vs1 c2vs1 asa(config)# context c3 asa(config-ctx)# allocate-ips vs0 c3vs0 asa(config-ctx)# allocate-ips vs1 c3vs1 asa(config-ctx)#

Step 7 Configure MPF for each context.

Note The following example shows context 3 (c3).

asa(config)# context c3 asa/c3(config)# class-map any asa/c3(config-cmap)# match access-list any asa/c3(config-cmap)# exit asa/c3(config)# policy-map ips_out asa/c3(config-pmap)# class any

asa/c3(config-pmap-c)#ips promiscuous fail-close sensor c3vs1 asa/c3(config-pmap-c)#policy-map ips_in asa/c3(config-pmap)#class any

asa/c3(config-pmap-c)#ips inline fail-open sensor c3vs0 asa/c3(config-pmap-c)#service-policy ips_out interface outside asa/c3(config)# service-policy ips_in interface inside asa/c3(config)#

Step 8	Confirm the configuration.
	asa/c3(config)# exit
	asa(config)# show ips detail
	Sensor Name	Sensor ID	Allocated To	Mapped Name
	-----------	---------	------------	-----------
	vs0	1	admin	adminvs0
			c3	c3vs0
	vs1	2	c2	c2vs1
			c3	c3vs1
	asa(config)#

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		19-9