Cisco Cisco ASA 5580 Adaptive Security Appliance Technical Manual

Cisco

21

XML Examples for the Cisco Application Centric Infrastructure Security Device Package, Version 1.2(1)

SourceFire

<vnsAbsGraph name = "WebGraph">

<vnsAbsNode name = "FW1">

<vnsAbsDevCfg>

<vnsAbsFolder key="Interface" name="internalIf">

<vnsAbsFolder key="ServicePolicy" name="IPS-Policy">

<vnsAbsParam key="ServicePolicyState" name="PolicyState" value="enable"/>

<vnsAbsFolder key="IPS" name="IPS">

<vnsAbsCfgRel key="TrafficSelection" name="TrafficSelect" targetName="ACL1"/>

<vnsAbsFolder key="IPSSettings" name="IPSSettingsA">

<vnsAbsParam key="operate_mode" name="operate_mode" value="inline"/>

<vnsAbsParam key="fail_mode" name="fail_mode" value="fail-open"/>

</vnsAbsFolder>

</vnsAbsFolder>

</vnsAbsFolder>

</vnsAbsFolder>

</vnsAbsDevCfg>

</vnsAbsNode>

</vnsAbsGraph>

</fvTenant>

</polUni>

SourceFire

This XML example shows a basic Sourcefire configuration in fail-open and monitor-only mode.

ASA Configuration

access-list ACL1 extended permit ip any any

class-map sfr_internalIf

match access-list ACL1

policy-map internalIf

class sfr_internalIf

sfr fail-open monitor-only

XML Example

<polUni>

<fvTenant name="tenant1">

<vnsAbsGraph name = "WebGraph">

<vnsAbsNode name = "FW1">

<vnsAbsDevCfg>

<vnsAbsFolder key="AccessList" name="ACL1">

<vnsAbsFolder key="AccessControlEntry" name="ACE1">

<vnsAbsParam key="action" name="action1" value="permit"/>

<vnsAbsParam key="order" name="order1" value="1"/>

</vnsAbsFolder>

</vnsAbsFolder>

<vnsAbsFolder key="Interface" name="internalIf">

<vnsAbsFolder key="ServicePolicy" name="SFR-Policy">

<vnsAbsParam key="ServicePolicyState" name="PolicyState"

value="enable"/>

<vnsAbsFolder key="SFR" name="SFR">

<vnsAbsCfgRel key="TrafficSelection" name="TrafficSelect"

targetName="ACL1"/>

<vnsAbsFolder key="SFRSettings" name="SFRSettings">