Configuring the Cisco ASA IPS Module
- ASA IPS Module Details
- ASA IPS Module Operation / Virtual Sensors
- ASA IPS Module Configuration
With the ongoing threat of network attacks existing for almost all companies that are connected to the Internet, there is often a need to set up some type of intrusion detection system (IDS) or intrusion protection system (IPS).
The main differences between an IDS and an IPS is in what happens when the device detects an attack. An IDS will detect the attack and alert the network administrators/engineers; an IPS has the ability to directly block the attack traffic once it has been detected. This can proactively prevent a good amount of damage to the internal network.
Cisco's Adaptive Security Appliance (ASA) line adds this ability with an additional piece of hardware of software, depending on the base ASA model. Sean Wilkins takes a look at this additional capability, what it offers, and how it can be configured to monitor traffic through an ASA.
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
With the ongoing threat of network attacks existing for almost all companies that are connected to the Internet, there is often a need to set up some type of intrusion detection system (IDS) or intrusion protection system (IPS). These systems' main purpose is to detect attacks as they are being initiated; this detection is done by comparing the streams of incoming traffic against a database of known attacks.
The main differences between an IDS and an IPS is in what happens when the device detects an attack. An IDS will detect the attack and alert the network administrators/engineers; an IPS has the ability to directly block the attack traffic once it has been detected. This can proactively prevent a good amount of damage to the internal network.
Cisco's Adaptive Security Appliance (ASA) line adds this ability with an additional piece of hardware of software, depending on the base ASA model. This article takes a look at this additional capability, what it offers. and how it can be configured to monitor traffic through an ASA.
ASA IPS Module Details
The exact details of the IPS functionalities of an ASA depend on the specific model of ASA that is being used. The ASA 5505, 5510, 5520, 5540, 5580, and 5585-X all use an additional hardware module that is inserted into the ASA chassis. The ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X all use an additional software module that is uploaded to the ASA.
The connection to manage the ASA module differs also by the model of the ASA used:
- ASA 5505: The ASA 5505 IPS module does not have an external management interface and is managed using a management VLAN within the ASA. By default, the VLAN that is used is 1, and the default IPS management IP address is 192.168.1.2.
- ASA 5510, ASA 5580, ASA 5585-X: These devices have an external management interface that is used to configure the device and the IPS module; the ASA 5585-X actually has several external management interfaces. With these devices, the ASA and the ASA IPS module are typically assigned with IP addresses that are on the same subnet (default: ASA – 192.168.1.1, ASA IPS – 192.168.1.2). It is also possible to configure the ASA to be managed via an inside interface while the ASA IPS module is solely managed via the external management interface.
- ASA 5512-X, ASA 5555-X: These devices work similarly to the previous models with an external management interface and with the same default IP addresses.