In very high-bandwidth applications, IPS-only appliances are also offered by Cisco. All traffic that is configured in the inline operational mode is limited to the overall throughput possible with the specific ASA IPS module (it differs considerable by which model and module). However, there are downsides to its add-on functionality. The ASA IPS module opens up the possibility of using a single appliance to do a number of things. Note: When the ASA is configured to fail-close, all traffic will be dropped if the ASA IPS module is unable to be contacted.Īsa(config-pmap-c)# ips Note: Multiple class maps can be linked to the same policy map.Ĭonfigure the traffic that has been match to be sent to the ASA IPS module. Link the previously created class map with the policy. Note: there are a number of different match statement possibilities.

Specify a traffic match statement (or statements)

Table 2 : ASA IPS Module Session Methods (ASA 5510+)

For the models using a software IPS module, there are two different methods to do this, as shown in Table 2: The gateway is the IP address of this same VLAN interface.Īsa# hw-module module 1 ip ip_address netmask gatewayĬonfigure the host(s) that are allowed to access the ASA IPS Module management address.Īsa# hw-module module 1 allow-ip ip-address netmaskįor all other ASA modules, the first step is to session into the ASA IPS module. Note: This IP address must be in the same subnet as the management VLAN interface configured in step 5. Enter interface configuration mode (this is the current management VLAN interface).Įnter interface configuration mode (this is the new management VLAN interface).Ĭonfigure the ASA IPS module management IP address.

Cisco asa 5505 configuration example