AutoUpdate Signature on Cisco ASA IPS software

[Steven Williams]

I am trying to configure the software based classic IPS module on the ASA to auto update the signature file. Something I do not understand is how to allow this. The IPS interfaces essentially have an IP address that is shared with the mgmt. subnet/vlan. Because the mgmt. interface is management only, it doesn't allow me to create an ACL to allow this traffic outbound to the internet? Suggestions?

[game123]

The IPS will only update online via its Management IP address , since regular sensor interfaces have no IP address setting option!

You need to default route your traffic from IPS to go to internet cloud and set permission on firewalls or routers to reach the IP address of IPS online databank signature website.

You do not need to have static NAT and , simple dynamic NAT is enough since the inside IPS management IP need not to be exposed or mapped directly and can use random source ports to connect to IPS Global databank over the internet using authenticated and authorized username/password combo which will be fed to the IPS device within the network.

hope this helps.