topic Re: Need Help Setting up AIP SSM in Network Security

Need Help Setting up AIP SSM

rafrancis — Sun, 10 Mar 2019 12:02:38 GMT

I am currently configuring an AIP SSM module on an ASA, and I would like to know which interface IP address should be used for the management interface. Should it be the outside interface of the ASA or the inside interface of the ASA?

Re: Need Help Setting up AIP SSM

Jennifer Halim — Wed, 30 Jun 2010 00:54:47 GMT

Majority of the times, you would be managing the module from your internal network, hence most people configure the management interface with ip address from the inside network.

Hope that helps.

Re: Need Help Setting up AIP SSM

rafrancis — Wed, 30 Jun 2010 01:07:13 GMT

I also will be setting up the AIP SSM on two ASA's running Active/Standby, so I would like to know if I have to doing any configurations on the Standby. Or when I saved the configuration on the Active, will the AIP SSM configuration replicate to the Standby ASA?

Re: Need Help Setting up AIP SSM

Jennifer Halim — Wed, 30 Jun 2010 01:09:18 GMT

No, you would need to manually configure both AIP module as the failover configuration synchronization is only for the ASA, not for the module.

You would need to configure unique/different ip address for each of the AIP module.

Hope that helps.

Re: Need Help Setting up AIP SSM

rafrancis — Wed, 30 Jun 2010 01:22:25 GMT

Is it best to setup the AIP SSM using the IME or just from co

mmand line? Also, where can I get info on

how to use the IME to provision the AIP SSM on the ASA?

Re: Need Help Setting up AIP SSM

Jennifer Halim — Wed, 30 Jun 2010 01:25:24 GMT

you won't be able to use IME to provision the AIP. Session into the module from the ASA, then run the "setup" command, and it will run you through the basic network connectivity setup. Once you have the ip address configured, you can use IME to manage the module.

Re: Need Help Setting up AIP SSM

rafrancis — Wed, 30 Jun 2010 01:31:58 GMT

Is it possible to add the license and upgrade AIP SSM from the IME? Or do those have to be done from the CLI?

Re: Need Help Setting up AIP SSM

Jennifer Halim — Wed, 30 Jun 2010 01:54:49 GMT

License and upgrade can be done through IME.

Here is the documentation guide for IME for your reference:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/ime/imeguide7.html

Re: Need Help Setting up AIP SSM

rafrancis — Wed, 30 Jun 2010 02:03:24 GMT

I really appreciate your answers. But one last question,

please point me to where I can get the syntax to setup Auto Update.

Re: Need Help Setting up AIP SSM

Jennifer Halim — Wed, 30 Jun 2010 02:06:08 GMT

Here is the Auto Update configuration guide:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/ime/ime_sensor_management.html#wp2016040

Re: Need Help Setting up AIP SSM

rafrancis — Wed, 30 Jun 2010 20:28:11 GMT

Please let me know how to configure the AIP SSM to monitor

Remote VPN Traffic.

Re: Need Help Setting up AIP SSM

Jennifer Halim — Thu, 01 Jul 2010 02:12:32 GMT

When you configured the ASA to send the traffic towards the AIP module to be inspected, you can configure specific ACL for traffic that you would like to inspect, or otherwise, you can just configure "permit ip any any" ACL to inspect everything going through the ASA.