topic Re: AIP-SSM configuration / blocking SMTP in Network Security

AIP-SSM configuration / blocking SMTP

carlos.allevato — Sun, 10 Mar 2019 10:54:43 GMT

Hi all,

I need some help regarding a deployment of a IPS module on a ASA. I configured it in transparent mode, with the intention to only monitor the traffic going through the module. Otherwise after aplying the policy and put it in operation, it started blocking SMTP and ICMP traffic. Here follows the configuration applied to it:

class-map outside-class

match any

policy-map outside-policy

class outside-class

ips promiscuous fail-open

service-policy outside-policy interface outside

Is there anything else I should consider to put this module just monitoring the traffic instead of having it denying any traffic?

Thanks in Advance

Re: AIP-SSM configuration / blocking SMTP

marcabal — Tue, 18 Dec 2007 16:55:03 GMT

You may need to create an access-list permitting all traffic, and then apply the access-list to both interfaces in both directions (in and out).

This will ensure connections can go from the lower security zone to the higher as well as from the higher security zone to the lower.

You may also need to add icmp permit lines to permit icmp traffic through each interface.

Re: AIP-SSM configuration / blocking SMTP

carlos.allevato — Tue, 18 Dec 2007 17:15:39 GMT

Thanks Marcabal for your reply. I'll proceed with the changes and let you know about the results.