C-65
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix C Troubleshooting
Troubleshooting the ASA5500-X IPS SSP
Mod-ips 601> Create node:
Mod-ips 602> ln: /etc/modprobe.conf: File exists
Mod-ips 603> Shutting down network... ifconfig lo down
Mod-ips 604> ifconfig lo down
Mod-ips 605> done
Mod-ips 606> Load ihm:
Mod-ips 607> Create node:
Mod-ips 608> Load kvm_ivshmem: IVSHMEM: writing 0x0 to 0xc86cf8
Mod-ips 609> IVSHMEM: IntrMask write(w) val = 0xffff
Mod-ips 610> Create node:
Mod-ips 611> Create node:
Mod-ips 612> Create node:
Mod-ips 613> Set Irq Affinity ... cpus: 6
Mod-ips 614> Starting network... ifconfig lo 127.0.0.1 netmask 255.255.255.255 up
Mod-ips 615> done
Mod-ips 616> Creating boot.info[ OK ]
Mod-ips 617> Checking for system modifications since last boot[ OK ]
Mod-ips 618> Checking model identification[ OK ]
Mod-ips 619> Model: ASA-5555
Mod-ips 620> Model=ASA-5555
Mod-ips 621> Unable to set speed and duplex for user mode interfaces
Mod-ips 622> interface type 0x8086:0x100e at pci address 0:6.0(0) is currently named eth1
Mod-ips 623> Renaming eth1 --> ma0_0
Mod-ips 624> interface type 0x8086:0x100e at pci address 0:7.0(0) is currently named po0_0
Mod-ips 625> interface type 0x8086:0x100e at pci address 0:5.0(0) is currently named eth0
Mod-ips 626> Renaming eth0 --> sy0_0
Mod-ips 627> Initializing access list
Mod-ips 628> MGMT_INTFC_CIDS_NAME Management0/0
Mod-ips 629> MGMT_INTFC_OS_NAME ma0_0
Mod-ips 630> SYSTEM_PCI_IDS 0x0030,0x0028
Mod-ips 631> Load rebootkom:
Mod-ips 632> root: Starting SSM controlplane
Mod-ips 633> Starting CIDS:
Mod-ips 634> starting pid 1718, tty '/dev/ttyS0': '/sbin/getty -L ttyS0 9600 vt100'
Failover Scenerios
The following failover scenarios apply to the ASA 5500-X series in the event of configuration changes,
signature/signature engine updates, service packs, and SensorApp crashes on theASA 5500-X IPS SSP.
Single ASA in Fail-Open Mode
•
If the ASA is configured in fail-open mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a configuration change or signature/signature engine update,
traffic is passed through the ASA without being inspected.
•
If the ASA is configured in fail-open mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is passed
through the ASA without being inspected.
Single ASA in Fail-Close Mode
•
If the ASA is configured in fail-close mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a configuration change or a signature/signature engine update,
traffic is stopped from passing through the ASA.
•
If the ASA is configured in fail-close mode for the ASA 5500-X IPS SSP, and the
ASA 5500-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is stopped
from passing through the ASA.