cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Cisco ASA-SSM-20 Analysis Engine Error

1063
Views
5
Helpful
0
Comments

Problem

IPS connected with ASA is not able to inspect the traffic and signature update gets failed.

 

ips.png

ips2.png

 

Solution

All sensors should have a virtual sensor assigned to them so they can inspect traffic.

Run the following commands to assign the virtual sensor

service analysis-engine

virtual-sensor vs0

physical-interface gi0/1

 

From the ASA

"do sh service-policy" and determine how many packets are being exchanged between the IPS and the ASA

Scenario 2:

Problem:

Is it possible for SSM-20 to stream to syslog? User can't find any mention in the documentation on how to configure this.The objective is simple: all SSM-20 generated events are sent to syslog using the good old UDP method.Then the syslog server will do some data mining;User is using Manage Engine's product which has produced great results with other Cisco devices. If the SSM-20 CAN NOT stream to syslog directly what ideas do experts have in order to get those events pushed to syslog? Could the ASA be used as a proxy?

 

Solution:

No, you can't send events to the ASA.

SNMP Traps was the workaround. There is no syslog for signature events on Cisco IPS Sensors. Now if you want to wait till you get a Sourcefire image running on a 5500-X platform, THEN you can get syslogs.