aip-ssm default behaviour

mulhollandm — Sun, 10 Mar 2019 12:29:40 GMT

folks

i've only realised that my aip-ssm only reports on traffic which is passed through the firewall acl

my requirement is that i log all attempted intrusions regardless of whether they are permitted through the firewall or not

does anyone know if i can change the default behaviour of the asa to let the module see the all traffic hitting the external interface?

thanks to anyone taking the time to reply

aip-ssm default behaviour

Dustin Ralich — Mon, 10 Oct 2011 15:19:50 GMT

i've only realised that my aip-ssm only reports on traffic which is passed through the firewall acl
does anyone know if i can change the default behaviour of the asa to let the module see the all traffic hitting the external interface?

The architecture is such that only traffic that is allowed through the ASA is passed to the AIP-SSM/AIP-SSC for inspection. The idea being that there is no reason to tie up more resources inspecting traffic that has already been dropped/denied.

my requirement is that i log all attempted intrusions regardless of whether they are permitted through the firewall or not

If the ASA itself is dropping traffic, a syslog message should be generated/logged. Between the ASA logs and the sensor module logs, you should have what you need.

topic aip-ssm default behaviour in Network Security

aip-ssm default behaviour

aip-ssm default behaviour