Solved

ASA 5510 CSC-SSM 10 Module

Posted on 2014-11-05
4
34 Views
Last Modified: 2016-07-17
i have one cisco ASA 5510 firewall with CSC-SSM 10 Module, which i use for filtering, its working good, i am sending all the the traffic to CSC-SSM module for scanning,  i do not want to send some destination traffic to CSC-SSM 10 module for scanning, those destinations are two ip addresses, if traffic is going to these two ip addresses, i do not want ASA to send that traffic to CSC-SSM module.
0
Comment
Question by:Ajeet Kumar
  • 2
4 Comments
 
LVL 24

Accepted Solution

by:
Ken Boone earned 500 total points
ID: 40424089
So in your config you should have something like this:

access-list IPS permit ip any any

class-map my_ips_class
 match access-list IPS
 class-map all_traffic
  match access-list all_traffic
 class-map inspection_default
  match default-inspection-traffic
 !
 !
 policy-map my-ids-policy
  class my-ips-class
   ips promiscuous fail-close
 !
 service-policy my-ids-policy global


BTW.. this sample was taken from : http://www.cisco.com/c/en/us/td/docs/security/ips/6-0/configuration/guide/cli/cliguide/cliSSM.html#wp1030972

So what you need to do is change your IPS access-list.
Instead of  just this:

access-list IPS permit ip any any

do this
access-list IPS deny ip any host x.x.x.x
access-list IPS deny ip host x.x.xx any
access-list IPS deny ip any host y.y.y.y
access-list IPS deny ip host y.y.y.y any
access-list IPS permit ip any any

x.x.x.x and y.y.y.y are the two destination or sources you do not want to scan.  Make sure the ACL is in that order with the permit ip any any at the bottom.
0
 
LVL 24

Expert Comment

by:Ken Boone
ID: 41714584
I provided a valid solution in my comments.  I gave an example with detailed instructions.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Read about achieving the basic levels of HRIS security in the workplace.
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now