Any downtime if you reset the sensor

[Wai Nam Mao]

Hi All

     I am wondering if i reboot the sensor, any downtime will caused?

[Wai Nam Mao]

Platform: ASA-SSM-10

[tiwang]

hi wai

depends on your ips policy - if you bypass it or block traffic. If you have the ASA's in a HA cluster this will cause a fail-over

best regards /ti

[Wai Nam Mao]

so if i just use the AIP as sniffer only

I can reset the AIP safely?

am i correct?

[tiwang · Accepted solution]

hi again

Try to take a look here - this is a config example from ver 6.0 but doesn't matter

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliSSM.html#wp1038548

depends on the asa policy you have defined would I say (and - do you have a ASA in HA mode?) - in step 7 here is shown the options you have:

Step 1 Log in to the adaptive security appliance.

Step 2 Enter configuration mode.

asa# configure terminal

Step 3 Create an IPS access list.

asa(config)# access-list IPS permit ip any any

Step 4 Define the IPS traffic class.

asa(config)# class-map class_map_name

asa(config-cmap)# match {access-list | any}

Step 5 Define the IPS policy map.

asa(config-cmap)# policy-map policy_map_name

Step 6 Identify the class map from Step 5 to which you want to assign an action.

asa(config-pmap)# class class_map_name

Step 7 Assign traffic to the AIP SSM.

asa(config-pmap-c)# ips {inline | promiscuous} {fail-close | fail-open}

Step 8 Define the IPS service policy.

asa(config-pmap-c)# service-policy policymap_name [global | interface interface_name]

Step 9 Verify the settings.