Configuring AIP SSM to monitor only

[JACQUES DU PLESSIS]

Hi all,

We purchased an AIP-SSM-20 for our ASA5520. Is there a way to enable IPS functionality, but not block anything, i.e. just log events? This is just to see if any legitimate company traffic will be blocked.

Thanks!

Jacques

[gbekmezi · Accepted solution]

Configure the ASA to send traffic to the IPS in promiscuous mode using the following command in a policy-map:

hostname(config-pmap-c)# ips {inline | promiscuous} {fail-close |

fail-open} [sensor {sensor_name | mapped_name}]

http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5500/quick/guide/aipssm.html

Geroge