Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-15
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA IPS Module
Configuring the ASA IPS module
Examples
The following example configures VLAN 20 as the IPS management VLAN. Only the host at 10.1.1.30
can access the IPS management IP address. VLAN 20 is assigned to switch port Ethernet 0/0. When you
connect to ASDM on ASA interface 10.1.1.1, ASDM then accesses the IPS on 10.1.1.2.
hostname(config)# interface vlan 1
hostname(config-if)# no allow-ssc-mgmt
hostname(config-if)# interface vlan 20
hostname(config-if)# nameif management
hostname(config-if)# ip address 10.1.1.1 255.255.255.0
hostname(config-if)# security-level 100
hostname(config-if)# allow-ssc-mgmt
hostname(config-if)# no shutdown
hostname(config-if)# hw-module module 1 ip 10.1.1.2 255.255.255.0 10.1.1.1
hostname(config)# hw-module module 1 allow-ip 10.1.1.30 255.255.255.255
hostname(config)# interface ethernet 0/0
hostname(config-if)# switchport access vlan 20
hostname(config-if)# no shutdown
Configuring the Security Policy on the ASA IPS Module
This section describes how to configure the ASA IPS module application.
Step 5
hw-module module 1 ip ip_address netmask
gateway
Example:
hostname# hw-module module 1 ip 10.1.1.2
255.255.255.0 10.1.1.1
Configures the management IP address for the ASA IPS module.
Make sure this address is on the same subnet as the ASA VLAN
IP address. For example, if you assigned 10.1.1.1 to the VLAN for
the ASA, then assign another address on that network, such as
10.1.1.2, for the IPS management address.
Set the gateway to be the ASA IP address for the management
VLAN. By default, this IP address is 192.168.1.1.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Step 6
hw-module module 1 allow-ip ip_address
netmask
Example:
hostname# hw-module module 1 allow-ip
10.1.1.30 255.255.255.0
Sets the hosts that are allowed to access the management IP
address.
Note These settings are written to the IPS application
configuration, not the ASA configuration. You can view
these settings from the ASA using the show module
details command.
You can alternatively use the IPS application setup
command to configure this setting from the IPS CLI.
Command Purpose

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English