topic AIP SSM Module Licensing Question in Network Security

AIP SSM Module Licensing Question

agent2007 — Sun, 10 Mar 2019 12:23:23 GMT

Hello,

If I put 2 AIP SSM Modeules in to a 2 Cisco ASA which are clustered, do I need a new license for the firewall? In the ASDM it complains about no valid license installed although the firewall picks up the cards and allows me to configure in CLI.

Help please

Re: AIP SSM Module Licensing Question

Jennifer Halim — Mon, 27 Jun 2011 06:55:55 GMT

Yes you do.

AIP SSM module is independant from the ASA. Each AIP SSM module would need its own license as it is tied to the serial number of the AIP SSM module.

AIP SSM Module Licensing Question

agent2007 — Mon, 27 Jun 2011 06:58:48 GMT

Tks so much for quick reply

AIP SSM Module Licensing Question

tiwang — Mon, 27 Jun 2011 06:58:53 GMT

hi again

Yes you do - they are seperate from the ASA's - remember also that even you have the ASA's in a fail-over cluster you need to maintain the configs on the IPS-blades manually - they are not synchroniced...

best regards /ti

Re: AIP SSM Module Licensing Question

agent2007 — Mon, 27 Jun 2011 07:00:43 GMT

really? I didnt know that. Thanks for pointing that out

Re: AIP SSM Module Licensing Question

agent2007 — Mon, 27 Jun 2011 08:57:40 GMT

Could I ask you one more question. When I sort out the licensing for the module, how do I go about appplying it to the asa. is ther a how to guide?

Re: AIP SSM Module Licensing Question

Jennifer Halim — Mon, 27 Jun 2011 09:00:03 GMT

You would need to apply the license from the AIP module itself.

Once the management interface on the AIP module is configured, then you can HTTPS (IDM) to the AIP module.

From there, it's pretty itutitive, just go to the License update section and it will connect to cisco.com and retrieve the license.

Re: AIP SSM Module Licensing Question

tiwang — Mon, 27 Jun 2011 09:07:22 GMT

IF you get trouble with the Java for that "%¤#"% IDM it is also quite simple to load the license (and config, updates etc) via the CLI -> from ASA issue the command session 1 - where you can logon to the AIP - from there you can load config and license files with the copy command and upgrade the os and signatyure files with the upgrade command

best regards /ti

Re: AIP SSM Module Licensing Question

tiwang — Mon, 27 Jun 2011 09:10:38 GMT

ps: you can easlily keep the config updated between the two AIP's by using the copy command - load the config file from the one AIP to the other and do not overwrite the network settings

Re: AIP SSM Module Licensing Question

agent2007 — Mon, 27 Jun 2011 09:16:46 GMT

Thanks guys

Re: AIP SSM Module Licensing Question

agent2007 — Mon, 27 Jun 2011 09:31:05 GMT

Thanks again for the tips.

What is the latest software version available for the AIP SSM and if it needed be upgraded is straight forward enough. also just one more question 🙂 how does it keep its signatures up to date?

Re: AIP SSM Module Licensing Question

tiwang — Mon, 27 Jun 2011 10:42:52 GMT

if you look in cisco.com/support for the AIP sw under ASA5500 you'll find that the latest version is some 7.0(5a).E4 - not sure what these extensions means

The module has some automatic upgrade feature for the signatures - I have newer tried this - we always do it the manual way - more not to forget the modules I think..