1-20
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA IPS Module
Configuring the ASA IPS module
Step 5
ips {inline | promiscuous} {fail-close |
fail-open} [sensor {sensor_name |
mapped_name}]
Example:
hostname(config-pmap-c)# ips promiscuous
fail-close
Specifies that the traffic should be sent to the ASA IPS module.
The inline and promiscuous keywords control the operating
mode of the ASA IPS module. See the “Operating Modes” section
on page 1-3 for more details.
The fail-close keyword sets the ASA to block all traffic if the ASA
IPS module is unavailable.
The fail-open keyword sets the ASA to allow all traffic through,
uninspected, if the ASA IPS module is unavailable.
(ASA 5510 and higher) If you use virtual sensors, you can specify
a sensor name using the sensor sensor_name argument. To see
available sensor names, enter the ips {inline | promiscuous}
{fail-close | fail-open} sensor ? command. Available sensors are
listed. You can also use the show ips command. If you use
multiple context mode on the ASA, you can only specify sensors
that you assigned to the context (see the “Assigning Virtual
Sensors to a Security Context (ASA 5510 and Higher)” section on
page 1-16). Use the mapped_name if configured in the context. If
you do not specify a sensor name, then the traffic uses the default
sensor. In multiple context mode, you can specify a default sensor
for the context. In single mode or if you do not specify a default
sensor in multiple mode, the traffic uses the default sensor that is
set on the ASA IPS module. If you enter a name that does not yet
exist on the ASA IPS module, you get an error, and the command
is rejected.
Step 6
(Optional)
class name2
Example:
hostname(config-pmap)# class ips_class2
If you created multiple class maps for IPS traffic, you can specify
another class for the policy.
See the “Feature Matching Within a Service Policy” section on
page 1-3 for detailed information about how the order of classes
matters within a policy map. Traffic cannot match more than one
class map for the same action type; so if you want network A to
go to sensorA, but want all other traffic to go to sensorB, then you
need to enter the class command for network A before you enter
the class command for all traffic; otherwise all traffic (including
network A) will match the first class command, and will be sent
to sensorB.
Command Purpose
To Next Page
Loading...
Need help?
General
