Cisco 5510 Getting Started Guide - Page 176

allocate-ips, default, Step 3

Page 176 highlights

Configuring the AIP SSM Chapter 13 Configuring the AIP SSM Step 3 Step 4 assigned to the context. If you specify a sensor name that does not yet exist on the AIP SSM, you get an error, but the allocate-ips command is entered as is. Until you create a sensor of that name on the AIP SSM, the context assumes the sensor is down. Use the mapped_name argument as an alias for the sensor name that can be used within the context instead of the actual sensor name. If you do not specify a mapped name, the sensor name is used within the context. For security purposes, you might not want the context administrator to know which sensors are being used by the context. Or you might want to genericize the context configuration. For example, if you want all contexts to use sensors called "sensor1" and "sensor2," then you can map the "highsec" and "lowsec" senors to sensor1 and sensor2 in context A, but map the "medsec" and "lowsec" sensors to sensor1 and sensor2 in context B. The default keyword sets one sensor per context as the default sensor; if the context configuration does not specify a sensor name, the context uses this default sensor. You can only configure one default sensor per context. If you want to change the default sensor, enter the no allocate-ips sensor_name command to remove the current default sensor before you allocate a new default sensor. If you do not specify a sensor as the default, and the context configuration does not include a sensor name, then traffic uses the default sensor on the AIP SSM. Repeat Step 1 and Step 2 for each context. To configure the context IPS policy, change to the context execution space using the following command: hostname(config-ctx)# changeto context context_name where the context_name argument is the name of the context you want to configure. Change to each context to configure the IPS security policy as described in "Diverting Traffic to the AIP SSM" section on page 13-11. The following example assigns sensor1 and sensor2 to context A, and sensor1 and sensor3 to context B. Both contexts map the sensor names to "ips1" and "ips2." In context A, sensor1 is set as the default sensor, but in context B, no default is set so the default that is configured on the AIP SSM is used. hostname(config-ctx)# context A hostname(config-ctx)# allocate-interface gigabitethernet0/0.100 int1 hostname(config-ctx)# allocate-interface gigabitethernet0/0.102 int2 13-10 Cisco ASA 5500 Series Getting Started Guide 78-19186-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208

Chapter 13
Configuring the AIP SSM
Configuring the AIP SSM
13-10
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
assigned to the context. If you specify a sensor name that does not yet exist on the
AIP SSM, you get an error, but the
allocate-ips
command is entered as is. Until
you create a sensor of that name on the AIP SSM, the context assumes the sensor
is down.
Use the
mapped_name
argument as an alias for the sensor name that can be used
within the context instead of the actual sensor name. If you do not specify a
mapped name, the sensor name is used within the context. For security purposes,
you might not want the context administrator to know which sensors are being
used by the context. Or you might want to genericize the context configuration.
For example, if you want all contexts to use sensors called “sensor1” and
“sensor2,” then you can map the “highsec” and “lowsec” senors to sensor1 and
sensor2 in context A, but map the “medsec” and “lowsec” sensors to sensor1 and
sensor2 in context B.
The
default
keyword sets one sensor per context as the default sensor; if the
context configuration does not specify a sensor name, the context uses this default
sensor. You can only configure one default sensor per context. If you want to
change the default sensor, enter the
no allocate-ips
sensor_name
command to
remove the current default sensor before you allocate a new default sensor. If you
do not specify a sensor as the default, and the context configuration does not
include a sensor name, then traffic uses the default sensor on the AIP SSM.
Step 3
Repeat
Step 1
and
Step 2
for each context.
Step 4
To configure the context IPS policy, change to the context execution space using
the following command:
hostname(config-ctx)#
changeto context
context_name
where the
context_name
argument is the name of the context you want to
configure. Change to each context to configure the IPS security policy as
described in
“Diverting Traffic to the AIP SSM” section on page 13-11
.
The following example assigns sensor1 and sensor2 to context A, and sensor1 and
sensor3 to context B. Both contexts map the sensor names to “ips1” and “ips2.”
In context A, sensor1 is set as the default sensor, but in context B, no default is set
so the default that is configured on the AIP SSM is used.
hostname(config-ctx)#
context
A
hostname(config-ctx)#
allocate-interface gigabitethernet0/0.100 int1
hostname(config-ctx)#
allocate-interface gigabitethernet0/0.102 int2