topic Re: Migrating from SSM-20 to SSM-40 in Network Security

Migrating from SSM-20 to SSM-40

harinirina — Sun, 10 Mar 2019 12:12:04 GMT

Hi all,

We're using SSM-20 for the moment and we plan to replace it with SSM-40. We'd like to know if

- the IOS supporting SSM-20 will also support SSM-40
- the ASA and module will keep the config or do we need to configure the module and signature again ?

In case we use new ASA, what is the best/easiest way to export the configuration of old IPS module/ASA to the new IPS/ASA ?

Re: Migrating from SSM-20 to SSM-40

Jennifer Halim — Fri, 03 Dec 2010 13:03:57 GMT

Which ASA models do you have at the moment?

AIP-SSM-40 is only supported on ASA5520 and 5540. Here is the URL for your reference:

http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html#~mid-range

The IPS configuration is independant to the ASA configuration. Therefore, if you are moving to a new module, you would need to reconfigure the AIP module from fresh. If you don't have any custom changes to the signatures, then you can just easily run the "setup" wizard to configure the network (ip address). It's pretty simple. And you then need to setup the signature update.

Hope that answers your question.

Re: Migrating from SSM-20 to SSM-40

harinirina — Fri, 03 Dec 2010 15:59:49 GMT

Thank you for your fast reply.

We're using ASA 5540. About the signature, some signatures have been customized but we don't have detailed information (it has been configured by someone else and it's not documentated ).

is there a way to export the configuration of the old AIP-SSM-20 (signature, event action, ... ) and import it to the new AIP-SSM-40 ?

Re: Migrating from SSM-20 to SSM-40

rhermes — Fri, 03 Dec 2010 17:00:22 GMT

Yes, it is pretty easy to export and import IPS configs, just like a router:

do a "show config" on your old AIP-SSM module, then when you log into the new one, paste in the saved config.

- Bob

Re: Migrating from SSM-20 to SSM-40

harinirina — Tue, 07 Dec 2010 12:41:07 GMT

Thank you for your reply.

In case an IOS IPS is used, how can we export / import the configuration of customized signature.

When we do "show run" on router configured with IOS IPS, there's no information about the signature customized in the output.

Re: Migrating from SSM-20 to SSM-40

harinirina — Mon, 13 Dec 2010 19:40:23 GMT

Hi again,

The output of the "show conf" is as below, does it mean that there is no customized signature?

! ------------------------------
service signature-definition sig0
signatures 3030 0
status
enabled true
exit
exit
exit
! ------------------------------
service ssh-known-hosts
exit
! ------------------------------
service trusted-certificates
exit
! ------------------------------
service web-server
exit
! ------------------------------
service anomaly-detection ad0
exit
! ------------------------------
service external-product-interface
exit
! ------------------------------
service analysis-engine
virtual-sensor vs0
physical-interface GigabitEthernet0/1
exit