topic Re: Disabling SIP in Network Security

Disabling SIP

man3mar3n — Tue, 12 Mar 2019 14:05:01 GMT

Hi,

I need to disable SIP in my FTD.

However, I don't have the options to issue the below command

configure inspection sip disable

I only have the below:

audit_cert             Change to Audit_cert Configuration Mode
configure              Change to Configuration mode
exit                   Exit Configuration Mode
expert                 Invoke a shell
history                Display the current session's command line history
kdump                  Enable or disable kernel crash dump data collection
log-events-to-ramdisk Configure Logging of Events to disk
log-ipconnection     Configure Logging of Connection Events
logout                 Logout of the current CLI session
manager                Change to Manager Configuration Mode
network                Change to Network Configuration Mode
password               Change password
show                 Change to Show Mode
system                 Change to System Mode
user                   Change to User Configuration Mode
vmware-tools           Configure state of VMware Tools

Can someone enlighten me on this issue?

Thank you very much.

Re: Disabling SIP

k.nandakumar — Mon, 12 Nov 2018 04:24:01 GMT

You have to use FlexConfig in FMC to disable SIP.

You'll find how to configure FlexConfig in below link. Have given some example. you may have to check the config to SIP.

https://www.youtube.com/watch?v=OMspnE9fq08

Regards,

Nanda

Securing Network With Firepower Threat Defense

Re: Disabling SIP

matty-boy — Mon, 12 Nov 2018 07:24:52 GMT

From the chevron '>' prompt, please show us the result from typing...

> configure ?

You should be able to disable it from command line if you wish.

Cheers,

Matt

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 07:30:13 GMT

Hi,

Below are the results from > Configure ?

> configure

Re: Disabling SIP

Abheesh Kumar — Mon, 12 Nov 2018 07:38:54 GMT

Hi,

Go to FTD clish

> configure inspection sip disable

will help you to disable sip inspection.

HTH

Abheesh

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 07:47:03 GMT

Hi,

That is what Cisco manual says as well.

But I don't see the option in the FTD clist.

I only see the below :

> configure

audit_cert                           Change to Audit_cert Configuration Mode
kdump                                 Enable or disable kernel crash dump data collection
log-events-to-ramdisk        Configure Logging of Events to disk
log-ips-connection             Configure Logging of Connection Events
manager                             Change to Manager Configuration Mode
network                              Change to Network Configuration Mode
password                            Change password
user                                    Change to User Confiuration Mode
vmware-tools                     Configure state of VMware Tools

Re: Disabling SIP

matty-boy — Mon, 12 Nov 2018 07:48:19 GMT

Please post output from > show version

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 07:49:46 GMT

Hi,

Below are my > sh version

> show version
-----------------[ xxxx-Firepower ]-----------------
Model                     : ASA5515 (72) Version 6.2.2 (Build 81)
UUID                      : 5795d1ba-741e-11e8-898d-dcdefb6d8f3b
Rules update version      : 2016-11-29-001-vrt
VDB version               : 271
----------------------------------------------------

Re: Disabling SIP

matty-boy — Mon, 12 Nov 2018 07:56:52 GMT

Weird. Are you logged in as a user with full admin rights?

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 08:01:32 GMT

Hi,

I logged in as admin.

There is only 1 user which is admin.

Re: Disabling SIP

Abheesh Kumar — Mon, 12 Nov 2018 08:02:51 GMT

are you managing this with FDM or FMC. If FMC you can do this via Flex config

Create a Flex Config Object and enter below command

policy-map global_policy
class inspection_default
no inspect sip

Then bind this Flex object to Flex Policy.

HTH

Abheesh

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 08:03:37 GMT

Hi,

My output from show user and show users

> show users
Login UID Auth Access Enabled Reset Exp Warn Str Lock Max
admin 100 Local Config Enabled No Never N/A Dis No N/A

> show user
Login UID Auth Access Enabled Reset Exp Warn Str Lock Max
admin 100 Local Config Enabled No Never N/A Dis No N/A

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 08:04:55 GMT

Hi,

I don't have FMC.

The firewall is with ASDM.

Re: Disabling SIP

matty-boy — Mon, 12 Nov 2018 08:07:10 GMT

So this is ASA with FP services? You’ll need to disable SIP inspection through ASDM or ASA CLI then, not through Firepower.

Re: Disabling SIP

matty-boy — Mon, 12 Nov 2018 08:08:55 GMT

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113069-asa-disgi-enai-asdm-00.html

Re: Disabling SIP

k.nandakumar — Mon, 12 Nov 2018 08:16:52 GMT

configure below CLI from ASA prompt config)# not from FirePOWER prompt >

*policy-map global_policy** class inspection_default*
*no inspect sip*

Re: Disabling SIP

man3mar3n — Mon, 12 Nov 2018 08:19:04 GMT

Hi,

Yes, this is ASA 5515x with Firepower Services.

I already disable it in ASA.

So that should be fine.

Thanks.

Re: Disabling SIP

ajay.bhat — Wed, 20 Nov 2019 14:42:30 GMT

THANKS ABHEESH