CSC-SSM - Data Plane Status:Down

[afshan_nava]

Hi

am a bit lost at the moment with my CSC-SSM-10  Service Module for the ASA 5510.... Pls Help me

i have installed the CSC module to the ASA5510-BUN-K9.... i have installed the BAse licence and Plus licence.  i could initiate a session to the Module  and Provide the basic configs (network, time, etc) through the command line..

But when i log in to the ASDM i do not see the "Content Filtering" Tab.. The Sh Module "sh module 1" output follows...

DaewooASA# sh module 1

Mod Card Type                                    Model              Serial No.

--- -------------------------------------------- ------------------ -----------

  1 ASA 5500 Series Content Security Services Mo ASA-SSM-CSC-10-K9  JAF1410APCA

Mod MAC Address Range                 Hw Version   Fw Version   Sw Version

--- --------------------------------- ------------ ------------ ---------------

  1 0026.99c0.b45b to 0026.99c0.b45b  1.0          1.0(11)5     CSC SSM 6.3.1172.0

Mod Status             Data Plane Status

--- ------------------ ---------------------

  1 Up                 Down

Note: the Data plane Status ;Down.

Thanks

Afshan

[mirober2]

Hi Afshan,

Can you check the output of 'show module 1 detail'? Make sure all of the services are up and the correct IP has been assigned.

Also, try resetting the module with the 'hw-module module 1 reset' command and see if the status changes to up.

Hope that helps.

-Mike

[afshan_nava]

Mike

check this out

                         Service Status

---------------------------------------------------------------------

The CSC SSM RegServer service is running

The CSC SSM URLFD service is running

The CSC SSM ScanServer service is running

The CSC SSM HTTP service is running

The CSC SSM FTP service is running

The CSC SSM Notification service is running

The CSC SSM Mail service is running

The CSC SSM GUI service is running

The CSC SSM SysMonitor service is running

The CSC SSM Failoverd service is running

The CSC SSM LogServer service is running

The CSC SSM SyslogAdaptor service is running

The CSC SSM Syslog-ng service is running

The CSC SSM TMCM-Agent service is not enabled

Do you want to restart all services? [y|n] n

as we can see the Trend micro service in not enabled.  I can login in to the module with https://192.168.50.1:8443 but do not see anywhere to enable a service....

thanks

[Jennifer Halim]

From the output, it seems that the module itself is up and running, hence you can configure it because the management port is separate to the data port.

The "data plane" status is showing down, that means that the connectivity between the module and the ASA itself is down.

I would suggest that you shutdown the module with the command: hw-module module 1 shutdown:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/gh.html#wp1782156

Then, physically reseat the module, and place it firmly back to the ASA module slot.

Hope that helps resolving the issue.

[Kureli Sankar]

If reseating shows the same status for Data plane pls. open a TAC case as the ASA/CSC may need to be replaced.

-KS

[afshan_nava]

jeNiffer

are you suggesting to rest the module to factory defaults? coz i have done a reload on the module but no luck...

BTW the physical connection to the ASA from the module is fine guess. coz i can ping back and forth.... and loging seperatly to the module on https://IP:8443

thanks

[afshan_nava]

jeNiffer

are you suggesting to rest the module to factory defaults? coz i have done a reload on the module but no luck...

BTW the physical connection to the ASA from the module is fine guess. coz i can ping back and forth.... and loging seperatly to the module onhttps://IP:8443

thanks

[Jennifer Halim]

No, i am not suggesting that you set it to factory defaults. The module itself is absolutely fine, that is why you can access it and configure it. You are accessing the module via the external port of the module (management port).

The problem lies between the module and the ASA backplane, where the data flows from the ASA through to the module to be inspected.

So as per my suggestion earlier, please shutdown the module, and reseat it (physically take the module out of the ASA and put it back in again firmly). This is to ensure that the backplane connectivity between the ASA and the module works.

[afshan_nava]

Guys

Issue resolved . I had a old IOS version on my ASA7.0.8, whereas the CSC-SSM supports above 7.1(1)....

http://www.cisco.com/en/US/partner/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6823/product_data_sheet0900aecd80402e4f.html

Thanks for the inputs

[Jennifer Halim · Accepted solution]

Great to hear and thanks for the update.

Please kindly mark the post as answered if you have no further question. Thanks.

[afshan_nava]

Did u answer it? anyway ill give u a five

[afshan_nava]

Dear

at the moment i have configured the CSC-SSM, and directed http traffic from just one user.... But Loading websites are very slow..

i tried disabling http scanning but no luck, its still the same..

URL filtering and blocking works fine though.

could i be missing something

pls help

Afshan

[Kureli Sankar]

Afshan,

Pls. check this document that I wrote: https://supportforums.cisco.com/docs/DOC-12671#Internet_traffic_is_very_slow

Remove http inspection if enabled.

-KS

[afshan_nava]

Sankar

i dont have http inspect enabled.. this is wht the policy map is. pls look-in to this

class-map inspection_default

match default-inspection-traffic

class-map csc_out_class

match access-list csc_out_list

!

!

policy-map type inspect dns migrated_dns_map_1

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns migrated_dns_map_1

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

<--- More --->

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

  inspect pptp

policy-map csc_out_policy

class csc_out_class

  csc fail-open

  set connection per-client-max 10

Thanks

[afshan_nava]

could it be a missmatch between my ASA software 8.0(4) and  CSC SSM 6.3.1172.0 ? But is it possible since the CSC is completely working on its own?