Custom IPS sigs on NGFW (ASA-CX) IPS solution?

[clausonna]

Hi folks,

I am trying to determine if it is possible to create custom IPS sigs on the ASA-CX module?  Not the ASA + Legacy IPS combo, but the ASA + ASA-CX (Application Detection, Web Filtering, IPS) combo.

I couldn't find anything in the docs that said this was possible.

Thanks!

Neil

[Ravi Singh]

Not with the current release. Currently, Cisco ASA Next-Generation Firewall Services include a robust set of more than 1200 applications and 150000 micro‑applications. The ability for administrators to create their own application signatures is a feature that will be included in a future release.

[clausonna]

Thank you for your response.  However my question was targeted towards Intrusion Prevention signatures such as the ones found on the traditional IPS units.  I would want the ability to use the various IPS engines such as Atomic IP, HTTP, etc and create sigs that match on things inside the packet, URL string, etc.

Thanks!

[Marvin Rhoads · Accepted solution]

No, those capabilities are not available with the NGFW IPS. Cisco currently recommends that the classic IPS (ASA module of stand-alone appliance) for customers requiring that capability.

Expect this all to change significantly over the coming year though as more of the SourceFire technology is integrated into the ASA product line.