Cisco ASA 5505 Configuration Manual page 1144

Information About the AIP SSM and SSC
How the AIP SSM/SSC Works with the Adaptive Security Appliance
The AIP SSM/SSC runs a separate application from the adaptive security appliance. The AIP SSM/SSC
does not contain any external interfaces itself (except for the management interface on the SSM only).
Traffic goes through the firewall checks before being forwarded to the AIP SSM/SSC. When you identify
traffic for IPS inspection on the adaptive security appliance, traffic flows through the adaptive security
appliance and the AIP SSM/SSC in the following way:
Figure 54-1
Operating Modes
You can send traffic to the AIP SSM/SSC using one of the following modes:
•
Cisco ASA 5500 Series Configuration Guide using ASDM
54-2
Traffic enters the adaptive security appliance.
a.
Firewall policies are applied.
b.
Traffic is sent to the AIP SSM/SSC over the backplane.
c.
See the "Operating Modes" section on page 54-2
the traffic to the AIP SSM/SSC.
The AIP SSM/SSC applies its security policy to the traffic, and takes appropriate actions.
d.
Valid traffic is sent back to the adaptive security appliance over the backplane; the AIP
e.
SSM/SSC might block some traffic according to its security policy, and that traffic is not passed
on.
VPN policies are applied (if configured).
f.
Traffic exits the adaptive security appliance.
g.
Figure 54-1 shows the traffic flow when running the AIP SSM/SSC. In this example, the AIP
SSM/SSC automatically blocks traffic that it identified as an attack. All other traffic is forwarded
through the adaptive security appliance.
AIP SSM/SSC Traffic Flow in the Adaptive Security Appliance
Security Appliance
Main System
VPN
inside
Policy
Diverted Traffic
IPS inspection
AIP SSM/SSC
Inline mode—This mode places the AIP SSM/SSC directly in the traffic flow (see
traffic that you identified for IPS inspection can continue through the adaptive adaptive security
appliance without first passing through, and being inspected by, the AIP SSM/SSC. This mode is the
Chapter 54 Configuring the IPS Application on the AIP SSM and SSC
for information about only sending a copy of
Firewall
Policy outside
Backplane
Block
Figure 54-1). No
OL-20339-01