AIP SSM - physical port query

[J_Vansen_S]

Hi all,

I have an ASA5520 with the AIP SSM module.

I would like to get a quick verification on 2 things.

1. AIP SSM module MUST have a physical ethernet port plugged to it, in order for IPS to function?
2. AIP SSM module IP Address has to be on a different IP range as the ASA5520 interfaces.?

Please correct me if i am wrong.

As i have a deployment of the ASA+AIP, but due to physical port imitation on our network, & also IP address; we might not be able to cater for the AIP module.

Please advise.

[Jennifer Halim · Accepted solution]

1. Physical ethernet port needs to be plugged and connected to the network for management purposes. To manage the AIP module itself for the IDM GUI.

2. No, it doesn't need to be on different IP range as the ASA interfaces. It is just another IP within your network, and it needs to be connected to the network via its management port (physical port on the AIP module itself), so it can be on another subnets within your ASA interfaces.

The only way you can manage the AIP module via GUI (IDM) is via its physical port. However, if you are happy to configure and manage the AIP module via command line, you can always just session via the ASA command line, however, it can be a hassle managing AIP via CLI.

[J_Vansen_S]

Thanks Jennifer for your verification.

2. So I cant use IP on the same subnet as my inside interface. It has to be on a different subnet.

Thanks again

[Jennifer Halim]

Yes, you can use IP on the same subnet as your inside interface. There is no problem at all. You can just set the AIP module IP Address in the same subnet as your inside interface, and default gateway as the ASA inside interface.