topic Re: CSC-SSM - Data Plane Status:Down in Network Security

CSC-SSM - Data Plane Status:Down

afshan_nava — Mon, 11 Mar 2019 19:18:13 GMT

am a bit lost at the moment with my CSC-SSM-10 Service Module for the ASA 5510.... Pls Help me

i have installed the CSC module to the ASA5510-BUN-K9.... i have installed the BAse licence and Plus licence. i could initiate a session to the Module and Provide the basic configs (network, time, etc) through the command line..

But when i log in to the ASDM i do not see the "Content Filtering" Tab.. The Sh Module "sh module 1" output follows...

DaewooASA# sh module 1

Mod Card Type Model Serial No.

--- -------------------------------------------- ------------------ -----------

1 ASA 5500 Series Content Security Services Mo ASA-SSM-CSC-10-K9 JAF1410APCA

Mod MAC Address Range Hw Version Fw Version Sw Version

--- --------------------------------- ------------ ------------ ---------------

1 0026.99c0.b45b to 0026.99c0.b45b 1.0 1.0(11)5 CSC SSM 6.3.1172.0

Mod Status Data Plane Status

--- ------------------ ---------------------

1 Up Down

Note: the Data plane Status ;Down.

Thanks

Afshan

Re: CSC-SSM - Data Plane Status:Down

mirober2 — Sat, 04 Dec 2010 18:02:40 GMT

Hi Afshan,

Can you check the output of 'show module 1 detail'? Make sure all of the services are up and the correct IP has been assigned.

Also, try resetting the module with the 'hw-module module 1 reset' command and see if the status changes to up.

Hope that helps.

-Mike

Re: CSC-SSM - Data Plane Status:Down

Jennifer Halim — Sun, 05 Dec 2010 00:41:46 GMT

From the output, it seems that the module itself is up and running, hence you can configure it because the management port is separate to the data port.

The "data plane" status is showing down, that means that the connectivity between the module and the ASA itself is down.

I would suggest that you shutdown the module with the command: hw-module module 1 shutdown:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/gh.html#wp1782156

Then, physically reseat the module, and place it firmly back to the ASA module slot.

Hope that helps resolving the issue.

Re: CSC-SSM - Data Plane Status:Down

Kureli Sankar — Sun, 05 Dec 2010 03:26:59 GMT

If reseating shows the same status for Data plane pls. open a TAC case as the ASA/CSC may need to be replaced.

-KS

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Sun, 05 Dec 2010 08:59:44 GMT

Mike

check this out

Service Status

---------------------------------------------------------------------

The CSC SSM RegServer service is running

The CSC SSM URLFD service is running

The CSC SSM ScanServer service is running

The CSC SSM HTTP service is running

The CSC SSM FTP service is running

The CSC SSM Notification service is running

The CSC SSM Mail service is running

The CSC SSM GUI service is running

The CSC SSM SysMonitor service is running

The CSC SSM Failoverd service is running

The CSC SSM LogServer service is running

The CSC SSM SyslogAdaptor service is running

The CSC SSM Syslog-ng service is running

The CSC SSM TMCM-Agent service is not enabled

Do you want to restart all services? [y|n] n

as we can see the Trend micro service in not enabled. I can login in to the module with https://192.168.50.1:8443 but do not see anywhere to enable a service....

thanks

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Sun, 05 Dec 2010 09:06:21 GMT

jeNiffer

are you suggesting to rest the module to factory defaults? coz i have done a reload on the module but no luck...

BTW the physical connection to the ASA from the module is fine guess. coz i can ping back and forth.... and loging seperatly to the module on https://IP:8443

thanks

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Sun, 05 Dec 2010 09:08:19 GMT

jeNiffer

are you suggesting to rest the module to factory defaults? coz i have done a reload on the module but no luck...

BTW the physical connection to the ASA from the module is fine guess. coz i can ping back and forth.... and loging seperatly to the module onhttps://IP:8443

thanks

Re: CSC-SSM - Data Plane Status:Down

Jennifer Halim — Sun, 05 Dec 2010 09:33:35 GMT

No, i am not suggesting that you set it to factory defaults. The module itself is absolutely fine, that is why you can access it and configure it. You are accessing the module via the external port of the module (management port).

The problem lies between the module and the ASA backplane, where the data flows from the ASA through to the module to be inspected.

So as per my suggestion earlier, please shutdown the module, and reseat it (physically take the module out of the ASA and put it back in again firmly). This is to ensure that the backplane connectivity between the ASA and the module works.

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Mon, 06 Dec 2010 10:55:57 GMT

Guys

Issue resolved . I had a old IOS version on my ASA7.0.8, whereas the CSC-SSM supports above 7.1(1)....

http://www.cisco.com/en/US/partner/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6823/product_data_sheet0900aecd80402e4f.html

Thanks for the inputs

Re: CSC-SSM - Data Plane Status:Down

Jennifer Halim — Mon, 06 Dec 2010 11:37:01 GMT

Great to hear and thanks for the update.

Please kindly mark the post as answered if you have no further question. Thanks.

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Mon, 06 Dec 2010 11:42:33 GMT

Did u answer it? anyway ill give u a five

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Wed, 08 Dec 2010 12:26:14 GMT

Dear

at the moment i have configured the CSC-SSM, and directed http traffic from just one user.... But Loading websites are very slow..

i tried disabling http scanning but no luck, its still the same..

URL filtering and blocking works fine though.

could i be missing something

pls help

Afshan

Re: CSC-SSM - Data Plane Status:Down

Kureli Sankar — Wed, 08 Dec 2010 13:26:20 GMT

Afshan,

Pls. check this document that I wrote: https://supportforums.cisco.com/docs/DOC-12671#Internet_traffic_is_very_slow

Remove http inspection if enabled.

-KS

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Wed, 08 Dec 2010 20:35:29 GMT

Sankar

i dont have http inspect enabled.. this is wht the policy map is. pls look-in to this

class-map inspection_default

match default-inspection-traffic

class-map csc_out_class

match access-list csc_out_list

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

<--- More --->

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect pptp

policy-map csc_out_policy

class csc_out_class

csc fail-open

set connection per-client-max 10

Thanks

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Wed, 08 Dec 2010 22:54:56 GMT

could it be a missmatch between my ASA software 8.0(4) and CSC SSM 6.3.1172.0 ? But is it possible since the CSC is completely working on its own?

Re: CSC-SSM - Data Plane Status:Down

Kureli Sankar — Thu, 09 Dec 2010 01:38:53 GMT

No. So long as the ASA code is about 7.1.1 it will detect the CSC module and the CSC code and ASA code is independent.

What is the per client-max 10 doing ? Could you pls. remove that from the class-map and try?

-KS

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Thu, 09 Dec 2010 09:29:13 GMT

"per client-max 10" is to limit the connections per client.... removing that didn't help

Re: CSC-SSM - Data Plane Status:Down

Kureli Sankar — Fri, 10 Dec 2010 03:54:28 GMT

Afshan,

I'd suggest opening a TAC case or a new thread. This thread has been answered and people do not focus on reading answered question when they are volunteeirng their time to help with open unanswered questions.

This issue now seems a little involved. We need to check the following:

1. CSC's path to the internet.

2. collect captures on the ASA for both the client and the CSC's traffic to the internet and compare to see if there is any delta.

-KS

Re: CSC-SSM - Data Plane Status:Down

afshan_nava — Fri, 10 Dec 2010 15:30:34 GMT

Shankar

thanks to ur effort i resolved the problem, as u suspected it was the connection to the internet. i had routed it through a proxy, which was working but slow. thats why i didnt suspect it was the proxy. Once i connected it withot a proxy it works fine

Thanks

Re: CSC-SSM - Data Plane Status:Down

manzeel — Fri, 22 Sep 2017 12:14:42 GMT

How Do U Solve This issue ?