Cisco Systems OL-16647-01 Using Virtual Sensors

28-3
Cisco ASDM User Guide
OL-16647-01
Chapter 28 Configuring IPS
AIP SSM Overview
• Promiscuous mode—This mode sends a duplicate stream of traffic to the AIP SSM. This mode is
less secure, but has little impact on traffic throughput. Unlike the inline mode, in promiscuous mode
the AIP SSM can only block traffic by instructing the adaptive security appliance to shun the traffic
or by resetting a connection on the adaptive security appliance. Also, while the AIP SSM is
analyzing the traffic, a small amount of traffic might pass through the adaptive security appliance
before the AIP SSM can shun it. Figure 28-2 shows the AIP SSM in promiscuous mode. In this
example, the AIP SSM sends a shun message to the security appliance for traffic it identified as a
threat.
Figure 28-2 AIP SSM Traffic Flow in the Adaptive Security Appliance: Promiscuous Mode
Using Virtual Sensors
The AIP SSM running IPS software Version 6.0 and later can run multiple virtual sensors, which means
you can configure multiple security policies on the AIP SSM. You can assign each context or single
mode security appliance to one or more virtual sensors, or you can assign multiple security contexts to
the same virtual sensor. See the IPS documentation for more information about virtual sensors, including
the maximum number of sensors supported.
Figure 28-3 shows one security context paired with one virtual sensor (in inline mode), while two
security contexts share the same virtual sensor.
Security Appliance
Main System
inside
AIP SSM
IPS inspection
outside
Backplane
VPN
Policy
Firewall
Policy
Shun
message
191314
Copied Traffic