topic Re: ASA modul IPS issue unkown (urgent) in Network Security

ASA modul IPS issue unkown (urgent)

Ibrahim Bhuiyan — Wed, 19 Aug 2020 17:37:33 GMT

See the below result of #Show module ips details

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH2042XXX
Firmware version: N/A
Software version: 7.1(7)E4
MAC Address Range: a0e0.af52.cb3b to a0e0.af52.cb3b
App. name: IPS
App. Status: Up
App. Status Desc: Normal Operation
App. version: 7.1(7)E4
Data Plane Status: Up
Console session: Ready
Status: Up
License: IPS Module Disabled perpetual
Mgmt IP addr: 192.168.1.2
Mgmt Network mask: 255.255.255.0
Mgmt Gateway: 192.168.1.1
Mgmt web ports: 443
Mgmt TLS enabled: true
Primary-FW#

Please see the first 3 line of orange color. result showed are unkown. what is the reason?

Re: ASA modul IPS issue unkown (urgent)

balaji.bandi — Wed, 19 Aug 2020 20:14:45 GMT

is that working one failed or is this new installation or any upgrades?

what is the outcome of #session sfr console?

Re: ASA modul IPS issue unkown (urgent)

Ibrahim Bhuiyan — Wed, 19 Aug 2020 21:41:06 GMT

with console i can connect to ips sensor. what for this was unkown message?

Note: I can connect through ASDM_IDM to IPS. IP block is same as network. but shows "error connecting to sensor: error loading sensor" can you tell me please what are the problems?

Primary-FW(config)# sh module ips

Mod Card Type Model Serial No .
---- -------------------------------------------- ------------------ --------- --
ips Unknown N/A FCH20427L GX

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ------------- --
ips a0e0.af52.cb3b to a0e0.af52.cb3b N/A N/A 7.1(7)E4

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- ------------------------- -
ips IPS Up 7.1(7)E4

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
ips Up Up

Mod License Name License Status Time Remaining
---- -------------- --------------- ---------------
ips IPS Module Disabled perpetual

Re: ASA modul IPS issue unkown (urgent)

balaji.bandi — Thu, 20 Aug 2020 09:26:51 GMT

At this stage we are not sure what was the issue,

If you could able to console to IPS, if you have maintenance window, reload the module and see of that fix the issue.

also check the IPS logs you have any indications

Re: ASA modul IPS issue unkown (urgent)

Ibrahim Bhuiyan — Thu, 20 Aug 2020 20:06:40 GMT

I did it several times. but result is same.

Re: ASA modul IPS issue unkown (urgent)

balaji.bandi — Thu, 20 Aug 2020 20:50:52 GMT

I am afraid to have any further suggestions - moving forward opening a cisco TAC case for a quick resolution.

Re: ASA modul IPS issue unkown (urgent)

Marvin Rhoads — Fri, 21 Aug 2020 02:45:22 GMT

You are looking at the old style past-end-of-life IPS sensor, not the current Firepower service module (sfr).

In either case the module uses the ASA's physical management interface to communicate for purposes of ASDM, updates etc. Can you confirm that the management interface is physically connected and that you can reach the sesnor itself directly via the address indicated? (not via the ASA address but via the sensor address)

Re: ASA modul IPS issue unkown (urgent)

Ibrahim Bhuiyan — Fri, 21 Aug 2020 09:40:29 GMT

Yes managent interface is connected and up. and I can ssh to the sensor successfully but not access through ASDM.

Re: ASA modul IPS issue unkown (urgent)

balaji.bandi — Fri, 21 Aug 2020 11:28:33 GMT

Sorry appolgies for the late reply.

So you able to access from console ? not able to access from ASDM

Can you post relavent configuraiton from ASA - correct Manangement VLAN allowed with the command "allow-ssc-mgmt"

or suggest to read this :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/97405-aipssm-unresponsive.html

Re: ASA modul IPS issue unkown (urgent)

Daniel Groth — Sun, 05 Jan 2025 12:54:40 GMT

Dear Ibrahim

The Problem is the version of ASDM, with ASDM 7.8 (1) you should be enable to connect to the ips software module.
Otherwise try the old, outdated Cisco IPS Manager Express. If you are able to to connect with IME to IPS your network is ok (or check to open an ssh to the asa and the ips)