Configuring AIP-10 module

[lhatwwp]

Hello,

I have had an ASA 5510 for a couple years now. Recently there is a push to have IPS services. I'm thinking of installing an AIP-10 module. Which brings me to a couple questions.

1) Is there a "good, simple" document that details the configuration of the AIP-10 module?

2) Can I configure the AIP module to send emails in the event of an attempted intrusion?

3) Is there anything I should look out for or consider before purchasing a AIP module?

Thanks,
Lou

 

[garnetbobcat]

1) The AIP SSM is really just an IPS Appliance on a card in the ASA. Nearly all the documentation that applies to the IPS Appliances applies to the AIP-SSM.

Sadly, I don't think there are "simple" docs pertaining to IPS configuration. In addition to checking out the links below, I recommend the Cisco Press book for the IPS exam of the CCSP.

Config guides:

http://www.cisco.com/en/US/products...stallation_and_configuration_guides_list.html

A basic setup from our blog, written by Joe:

http://www.wr-mem.com/?p=62

Having said that things are the same, there are some peculiar differences to note:

1a) The AIP module can only see traffic that crosses the backplane of the ASA, so you can only inspect traffic that goes from one interface to another. In order to inspect that traffic, you either need to divert it or mirror it to the AIP module. This is a good simple document:

ASA: Send Network Traffic from the ASA to the AIP SSM Configuration Example

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml

1b) Unlike a normal IPS appliance, the AIP SSM only has one "interface", the backplane connection to the ASA. This is the only one you can configure.

-----

2) The AIP module itself cannot send an email alert. You can send SNMP traps, though:

http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/idm/dmSNMP.html

Or you can use software like Cisco Security Monitor to do this. Here's an older link, but it shows the idea:

http://cisco.com/en/US/products/hw/...s_configuration_example09186a00801fc770.shtml

-----

3) I don't think there's anything in particular that you should "watch out" for with the AIP.

One general comment about the IPS: It can be noisy. Be prepared to get flooded with alerts and spend time tuning it to suit your environment.

Matt
CCIE Security

http://www.wr-mem.com

 

[garnetbobcat]

Typo! I wrote Cisco Security Monitor. I meant Manager

Matt
CCIE Security

http://www.wr-mem.com