topic Re: AIP-SSM interface in Network Security

AIP-SSM interface

uthayaman — Sun, 10 Mar 2019 11:55:43 GMT

What does the interface configuration in AIP-SSM indicates ?

If this indicates that the traffics of this interface will be monitored, then what is the purpose of diverting traffic from asa though policy command.

Re: AIP-SSM interface

Jennifer Halim — Wed, 17 Mar 2010 22:14:14 GMT

The external interface of the AIP-SSM module is purely for management (Command and Control interface). You would need to connect that to your network so you can manage the module (IDM).

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 09:16:51 GMT

I understood the AIP-SSM mgmt interface ip configuration.In the setup mode when we configure the aip ssm what does the below option represent.

Modify interface/virtual sensor configuration?[no]: yes

Current interface configuration

 Command control: Management0/0

 Unassigned:

  Monitored:

   GigabitEthernet0/1

 Virtual Sensor: vs0

  Anomaly Detection: ad0

  Event Action Rules: rules0

  Signature Definitions: sig0

  [1] Edit Interface Configuration

  [2] Edit Virtual Sensor Configuration

  [3] Display configuration

Option:

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 09:21:06 GMT

That is the command and control interface, ie: for management of the module (the ip address that you would https/IDM to).

Gig0/1 is the sensing interface, which is connected internally at the backplane of the ASA.

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 09:23:18 GMT

Here , the monitored interface represent my ASA's physical interfaces ?

If i have four physical interface on my ASA, whether i need to include all the inteface under this monitored option ?

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 09:29:23 GMT

No, the module is independant of the ASA as far as management/monitoring is concern. The interface is the physical interface on the module itself, not any of the interfaces of the ASA.

Here is the hardware visual of the SSM module where the physical interface is:

http://www.cisco.com/en/US/docs/security/asa/asa82/getting_started/asa5500/quick/guide/opt_card.html#wp1035895

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 09:32:44 GMT

Thx for the reply....

In which cases i have to change the interface settings.

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 09:34:18 GMT

Thanks, hope i've answered your questions.

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 10:09:57 GMT

under which condition i need to change this interface configuration, if this gig interface is the internal one.

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 10:12:03 GMT

Unfortunately for the AIP-SSM module, you are not able to change any of the interfaces.

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 10:40:18 GMT

But i got the option to add interface while configuring aip-ssm.Since i was not clear i didnt make a

ny change and came out of the configuration.

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 10:44:40 GMT

Because you choose "yes" to modify the configuration while going through the process:

Modify interface/virtual sensor configuration?[no]: yes

You can modify the management interface, ie: unassign it, and modify the sensing interface settings. However, you can not swap, or delete those interfaces.

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 10:55:45 GMT

Thanks for your valuble time!!!

Yes!!!

I did the same what you have mentioned.What will happen if i change the se

nsing interface(adding three sensing interfaces).Will it affect any performance.

Re: AIP-SSM interface

Jennifer Halim — Mon, 22 Mar 2010 11:15:21 GMT

Unfortunately you can't add anymore sensing interfaces on the AIP module. There is only 1 (gig0/1) of the module which is connected through the backplane of the ASA.

Here is how you configure traffic to be redirected towards the module from the ASA:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml

Note: You can only direct traffic to be inspected by the AIP module from the ASA. There is no other way.

Re: AIP-SSM interface

uthayaman — Mon, 22 Mar 2010 11:19:21 GMT

Thanks for the clarification...

I will re do the configuration and let you know.

Re: AIP-SSM interface

uthayaman — Sun, 28 Mar 2010 11:39:30 GMT

Hi,

I did the change and it is working fine.

I want to upgrade the image of my AIP-SSM.I am using aip-ssm-40.Can you suggest which version i can use and steps to upgrade.

Re: AIP-SSM interface

Jennifer Halim — Sun, 28 Mar 2010 23:26:26 GMT

I would suggest an upgrade to the latest version which is 7.0.2(E3). You can upgrade directly to that version if you are currently already running at least 5.1.6(E3).

To upgrade:

1) Download the upgrade package:

http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=7.0%282%29E3&mdfid=280432811&sftType=Intrusion+Prevention+System+%28IPS%29+System+Upgrades&optPlat=&nodecount=2&edesignator=null&modelName=Cisco+ASA+Advanced+Inspection+and+Prevention+%28AIP%29+Security+Services+Module&treeMdfId=268438162&treeName=Security&modifmdfid=null&imname=&hybrid=Y&imst=N&lr=Y

2) Go to IDM: Configuration --> Sensor Management --> Update Sensor --> upload the upgrade package from your local computer and update it.

Hope it helps.