54-2
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 54 Configuring the IPS Application on the AIP SSM and SSC
Information About the AIP SSM and SSC
How the AIP SSM/SSC Works with the Adaptive Security Appliance
The AIP SSM/SSC runs a separate application from the adaptive security appliance. The AIP SSM/SSC
does not contain any external interfaces itself (except for the management interface on the SSM only).
Traffic goes through the firewall checks before being forwarded to the AIP SSM/SSC. When you identify
traffic for IPS inspection on the adaptive security appliance, traffic flows through the adaptive security
appliance and the AIP SSM/SSC in the following way:
a. Traffic enters the adaptive security appliance.
b. Firewall policies are applied.
c. Traffic is sent to the AIP SSM/SSC over the backplane.
See the “Operating Modes” section on page 54-2 for information about only sending a copy of
the traffic to the AIP SSM/SSC.
d. The AIP SSM/SSC applies its security policy to the traffic, and takes appropriate actions.
e. Valid traffic is sent back to the adaptive security appliance over the backplane; the AIP
SSM/SSC might block some traffic according to its security policy, and that traffic is not passed
on.
f. VPN policies are applied (if configured).
g. Traffic exits the adaptive security appliance.
Figure 54-1 shows the traffic flow when running the AIP SSM/SSC. In this example, the AIP
SSM/SSC automatically blocks traffic that it identified as an attack. All other traffic is forwarded
through the adaptive security appliance.
Figure 54-1 AIP SSM/SSC Traffic Flow in the Adaptive Security Appliance
Operating Modes
You can send traffic to the AIP SSM/SSC using one of the following modes:
• Inline mode—This mode places the AIP SSM/SSC directly in the traffic flow (see Figure 54-1). No
traffic that you identified for IPS inspection can continue through the adaptive adaptive security
appliance without first passing through, and being inspected by, the AIP SSM/SSC. This mode is the
Security Appliance
Main System
inside
AIP SSM/SSC
Diverted Traffic
IPS inspection
outside
Backplane
VPN
Policy
Firewall
Policy
Block
251157
To Next Page
Loading...
Need help?
General
