Cisco ASA 5505 - Manual (Page 1239)

58-19
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 58 Configuring the ASA IPS Module
Configuring the ASA IPS module
Step 5 ips {inline | promiscuous} {fail-close |
fail-open } [sensor {sensor_name |
mapped_name}]
Example:
hostname(config-pmap-c)# ips promiscuous
fail-close
Specifies that the traffic should be sent to the ASA IPS module.
The inline and promiscuous keywords control the operating
mode of the ASA IPS module. See the
“Operating Modes” section
on page 58-2 for more details.
The fail-close keyword sets the ASA to block all traffic if the ASA
IPS module is unavailable.
The fail-open keyword sets the ASA to allow all traffic through,
uninspected, if the ASA IPS module is unavailable.
(ASA 5510 and higher) If you use virtual sensors, you can specify
a sensor name using the sensor sensor_name argument. To see
available sensor names, enter the ips {inline | promiscuous}
{fail-close | fail-open} sensor ? command. Available sensors are
listed. You can also use the show ips command. If you use
multiple context mode on the ASA, you can only specify sensors
that you assigned to the context (see the
“Assigning Virtual
Sensors to a Security Context (ASA 5510 and Higher)” section on
page 58-15
). Use the mapped_name if configured in the context.
If you do not specify a sensor name, then the traffic uses the
default sensor. In multiple context mode, you can specify a default
sensor for the context. In single mode or if you do not specify a
default sensor in multiple mode, the traffic uses the default sensor
that is set on the ASA IPS module. If you enter a name that does
not yet exist on the ASA IPS module, you get an error, and the
command is rejected.
Step 6 (Optional)
class name2
Example:
hostname(config-pmap)# class ips_class2
If you created multiple class maps for IPS traffic, you can specify
another class for the policy.
See the “Feature Matching Within a Service Policy” section on
page 32-3 for detailed information about how the order of classes
matters within a policy map. Traffic cannot match more than one
class map for the same action type; so if you want network A to
go to sensorA, but want all other traffic to go to sensorB, then you
need to enter the class command for network A before you enter
the class command for all traffic; otherwise all traffic (including
network A) will match the first class command, and will be sent
to sensorB.
Command Purpose