Cisco ASA Series Cli Configuration Manual page 1496

Configuring the ASA IPS module
Command
Step 5
ips {inline | promiscuous} {fail-close |
fail-open} [sensor {sensor_name |
mapped_name}]
Example:
hostname(config-pmap-c)# ips promiscuous
fail-close
Step 6
(Optional)
class name2
Example:
hostname(config-pmap)# class ips_class2
Cisco ASA Series CLI Configuration Guide
1-20
Chapter 1
Purpose
Specifies that the traffic should be sent to the ASA IPS module.
The inline and promiscuous keywords control the operating
mode of the ASA IPS module. See the
on page 1-3 for more details.
The fail-close keyword sets the ASA to block all traffic if the ASA
IPS module is unavailable.
The fail-open keyword sets the ASA to allow all traffic through,
uninspected, if the ASA IPS module is unavailable.
(ASA 5510 and higher) If you use virtual sensors, you can specify
a sensor name using the sensor sensor_name argument. To see
available sensor names, enter the ips {inline | promiscuous}
{fail-close | fail-open} sensor ? command. Available sensors are
listed. You can also use the show ips command. If you use
multiple context mode on the ASA, you can only specify sensors
that you assigned to the context (see the
Sensors to a Security Context (ASA 5510 and Higher)" section on
page 1-16). Use the mapped_name if configured in the context. If
you do not specify a sensor name, then the traffic uses the default
sensor. In multiple context mode, you can specify a default sensor
for the context. In single mode or if you do not specify a default
sensor in multiple mode, the traffic uses the default sensor that is
set on the ASA IPS module. If you enter a name that does not yet
exist on the ASA IPS module, you get an error, and the command
is rejected.
If you created multiple class maps for IPS traffic, you can specify
another class for the policy.
See the "Feature Matching Within a Service Policy" section on
page 1-3 for detailed information about how the order of classes
matters within a policy map. Traffic cannot match more than one
class map for the same action type; so if you want network A to
go to sensorA, but want all other traffic to go to sensorB, then you
need to enter the class command for network A before you enter
the class command for all traffic; otherwise all traffic (including
network A) will match the first class command, and will be sent
to sensorB.
Configuring the ASA IPS Module
"Operating Modes" section
"Assigning Virtual