Improve company productivity with a Business Account.Sign Up


ASA 5520 / AIP SSM-10 Configuration

Posted on 2011-03-10
Medium Priority
Last Modified: 2013-11-29
Can the ASA 5520 with the AIP SSM-10 operate as an independent IDS?

The "Policy Office" wants the firewall and the IDS separate. I've reviewed the documentation, and it appears that all AIP SSM-10 only operates with a firewall policy directing traffic to it... Hence my problem, I have an ASA 5520 running as an independent firewall.

My logic: SPAN a port on a switch and plug it directly into the AIP SSM-10... Launch the basic setup - I've attempted this via the CLI and the ADSM...

Thx in advance....
Question by:kdmiller220
  • 3
  • 2
LVL 18

Accepted Solution

jmeggers earned 2000 total points
ID: 35097794
You can configure the ASA to pass all traffic, which is obviously not the way it's intended to work.  The "firewall policy" you're referring to that directs traffic to the IDS is only there to do that redirection; it has nothing to do with the firewall aspects of the ASA (blocking inbound traffic from the untrusted side, maintaining the state of outbound connections, etc.).  So although I've never seen this done, there doesn't really seem to be any reason you couldn't have the ASA be wide open to traffic passing through, but still direct some traffic over to the IDS module for inspection.  Keep in mind there are some aspects of the ASA configuration you will have to deal with, such as NAT and routing.

Author Comment

ID: 35098998
Thank you - I just wanted to make SURE I was was on the right path.... Thx again!!!

Author Comment

ID: 35101560
There's no NAT, so I would assume a default route would suffice ... I'm able to ping the ASA ip (in), but not out.... I believe that my policy configs are intact - yet I see no evidence that the IDS module is logging any traffic (in both inline and promiscuous mode) in my lab via the IDM (vs0 is assigned)????

LVL 18

Expert Comment

ID: 35102722
Are you able to pass traffic through the ASA at all?  If you're not concerned about doing any firewalling, then I would be inclined to make both inside and outside equal security levels and permit same-security-level inter-interface (or whatever the correct syntax is). And yes, you should need a default route on the outside, and make sure the inside subnets are known by devices on the outside of the ASA.

Author Comment

ID: 35138298
I made the security level 0 - with a d-route... Now I'm no FW guru, but am I to assume the I have to 2 of the ASA interfaces vice one - traffic can't flow bi-directionally???

Going to test this now....(light bulb)

hostname xxx-ids-1
enable password xxxxxxxxxx encrypted
interface GigabitEthernet0/0
 no nameif
 no security-level
 no ip address
interface GigabitEthernet0/1
 nameif xxx-IN
 security-level 0
 ip address
interface GigabitEthernet0/2
 no nameif
 no security-level
 no ip address
interface GigabitEthernet0/3
 no nameif
 no security-level
 no ip address
interface Management0/0
 no nameif
 no security-level
 no ip address
passwd xxxxxxxxxx encrypted
ftp mode passive
access-list IPS extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu xxx-IN 1500
no failover
no asdm history enable
arp timeout 14400
route xxx-IN
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
class-map xxx-CLASS-MAP
 match access-list IPS
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
 class xxx-CLASS-MAP
  ips promiscuous fail-open
service-policy global_policy global


Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

A discussion about Penetration Testing and the Tools used to help achieve this important task.
In computing, Vulnerability assessment and penetration testing are used to assess systems in light of the organization's security posture, but they have different purposes.
Sending a Secure fax is easy with eFax Corporate ( First, just open a new email message. In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
In a question here at Experts Exchange (, a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question