C-71
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix C Troubleshooting
Troubleshooting the ASA5585-X IPS SSP
Slot-1 155> RETRY=20
Slot-1 156> tftp IPS-SSP_10-K9-sys-1.1-a-7.2-1.img@192.0.2.15 via 192.0.2.254
Slot-1 157> TFTP failure: Packet verify failed after 20 retries
Slot-1 158> Rebooting due to Autoboot error ...
Slot-1 159> Rebooting....
Slot-1 160> Cisco Systems ROMMON Version (1.0(10)0) #0: Fri Mar 25 23:02:10 PST 2010
Slot-1 161> Platform ASA5585-SSP-IPS20
Slot-1 162> GigabitEthernet0/0
Slot-1 163> Link is UP
Slot-1 164> MAC Address: 000b.fcf8.0176
Slot-1 165> ROMMON Variable Settings:
Slot-1 166> ADDRESS=192.0.2.3
Slot-1 167> SERVER=192.0.2.15
Slot-1 168> GATEWAY=192.0.2.254
Slot-1 169> PORT=GigabitEthernet0/0
Slot-1 170> VLAN=untagged
Slot-1 171> IMAGE=IPS-SSP_10-K9-sys-1.1-a-7.2-1.img
Slot-1 172> CONFIG=
Slot-1 173> LINKTIMEOUT=20
Slot-1 174> PKTTIMEOUT=4
Slot-1 175> RETRY=20
Slot-1 176> tftp IPS-SSP_10-K9-sys-1.1-a-7.2-1.img@192.0.2.15 via 192.0.2.254
Failover Scenarios
The following failover scenarios apply to the ASA 5585-X in the event of configuration changes,
signature/signature engine updates, service packs, and SensorApp crashes on the ASA 5585-X IPS SSP.
Single ASA 5585-X in Fail-Open Mode
•
If the ASA is configured in fail-open mode for the ASA 5585-X IPS SSP, and the
ASA 5585-X IPS SSP experiences a configuration change or signature/signature engine update,
traffic is passed through the ASA without being inspected.
•
If the ASA is configured in fail-open mode for the ASA 5585-X IPS SSP, and the
ASA 5585-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is passed
through the ASA without being inspected.
Single ASA 5585-X in Fail-Close Mode
•
If the ASA is configured in fail-close mode for the ASA 5585-X IPS SSP, and the
ASA 5585-X IPS SSP experiences a configuration change or a signature/signature engine update,
traffic is stopped from passing through the ASA.
•
If the ASA is configured in fail-close mode for the ASA 5585-X IPS SSP, and the
ASA 5585-X IPS SSP experiences a SensorApp crash or a service pack upgrade, traffic is stopped
from passing through the ASA.
Two ASA 5585-Xs in Fail-Open Mode
•
If the ASAs are configured in fail-open mode and if the ASA5585-X IPS SSP on the active ASA
experiences a configuration change or a signature/signature engine update, traffic is still passed
through the active ASA without being inspected. Failover is not triggered.
•
If the ASAs are configured in fail-open mode, and if the ASA 5585-X IPS SSP on the active ASA
experiences a SensorApp crash or a service pack upg rade, failover is triggered and traffic passes
through the ASA 5585-X IPS SSP that was previously the standby ASA5585- XIPS SSP.