Cisco ASA 5505 - Manual (Page 1233)

58-13
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 58 Configuring the ASA IPS Module
Configuring the ASA IPS module
Examples
The following example configures VLAN 20 as the IPS management VLAN. This VLAN is restricted
to management traffic only. Only the host at 10.1.1.30 can access the IPS management IP address. VLAN
20 is assigned to switch port Ethernet 0/0. When you connect to ASDM on ASA interface 10.1.1.1,
ASDM then accesses the IPS on 10.1.1.2.
hostname(config)# interface vlan 1
hostname(config-if)# no allow-ssc-mgmt
hostname(config-if)# interface vlan 20
hostname(config-if)# nameif inside
hostname(config-if)# ip address 10.1.1.1 255.255.255.0
hostname(config-if)# security-level 100
hostname(config-if)# allow-ssc-mgmt
hostname(config-if)# no shutdown
hostname(config-if)# management-only
hostname(config-if)# hw-module module 1 ip 10.1.1.2 255.255.255.0 10.1.1.1
hostname(config)# hw-module module 1 allow-ip 10.1.1.30 255.255.255.255
hostname(config)# interface ethernet 0/0
hostname(config-if)# switchport access vlan 20
hostname(config-if)# no shutdown
Step 5 hw-module module 1 ip ip_address netmask
gateway
Example:
hostname# hw-module module 1 ip 10.1.1.2
255.255.255.0 10.1.1.1
Configures the management IP address for the ASA IPS module.
Make sure this address is on the same subnet as the ASA VLAN
IP address. For example, if you assigned 10.1.1.1 to the VLAN for
the ASA, then assign another address on that network, such as
10.1.1.2, for the IPS management address.
If the management station is on a directly-connected ASA
network, then set the gateway to be the ASA IP address assigned
to the IPS management VLAN. In the above example, set the
gateway to 10.1.1.1. If the management station is on a remote
network, then set the gateway to be the address of an upstream
router on the IPS management VLAN.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Step 6 hw-module module 1 allow-ip ip_address
netmask
Example:
hostname# hw-module module 1 allow-ip
10.1.1.30 255.255.255.0
Sets the hosts that are allowed to access the management IP
address.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Command Purpose