Wednesday, September 26, 2007

Cisco IOS IPS

You can configure Cisco IOS IPS in three ways: Cisco Router CLI, Cisco Router and Security Device Manager (SDM) and CiscoWorks.
Only A basic set of Cisco IOS IPS commands is available in the CLI. The best way to configure CiscoIOS IPS is to use Cisco Router and Security Device Manager (SDM)

Basic Cisco IOS IPS Configuration Tasks
Step 1: Initialize the Cisco IOS IPS on the router
Gateway(config)#ip ips notify sdee
Gateway(config)#ip ips notify log

Gateway(config)#ip sdee alerts ?
<10-2000> Number of SDEE alerts to store
Gateway(config)#ip sdee messages ?
<10-500> Number of SDEE messages to store
Gateway(config)#ip sdee subscriptions ?
<1-3> Number of concurrent SDEE subscriptions

Step 2: Configure signatures
Gateway(config)#ip ips sdf location flash:128MB.sdf

Step 3: Creating and Applying IPS Rules
Gateway(config)#ip access-list extended IPSOutside
Gateway(config-ext-nacl)#100 permit ip any any
Gateway(config-ext-nacl)#exit
Gateway(config)#ip ips name IPSOutside list IPSOutside

Gateway(config-if)#ip ips
Gateway(config-if)#ip ips IPSOutside in

Step 4 Verifying the Cisco IOS IPS Configuration

Gateway#show ip ips all
Gateway#show ip ips configuration
Gateway#show ip ips interfaces
Gateway#show ip ips statistics
Gateway#show ip ips signatures

No comments: