Home > Articles > Cisco Network Technology > Security > Network Security Using Cisco IOS IPS

Network Security Using Cisco IOS IPS

Verifying IPS Operation

To verify the IPS configuration on the router, choose Configure > Intrusion Prevention > Edit IPS, as shown in Figure 6-27. The Edit IPS tab shows all the interfaces on the router and whether they are configured for Cisco IOS IPS. If Enabled appears in either the Inbound or the Outbound column, Cisco IOS IPS is enabled for that direction of traffic on that interface. If Disabled appears in either the Inbound or the Outbound column, Cisco IOS IPS is disabled for that direction on the interface.

Figure 6-27

Figure 6-27 Verifying IPS Policies

Cisco IOS IPS cannot identify the contents of IP fragments when VFR is not enabled, and it cannot gather port information from the fragment to match it with a signature. Therefore, fragments can pass through the network without being examined or without a dynamic ACL being created on the Cisco IOS Firewall. You will remember that VFR enables the Cisco IOS Firewall to examine out-of-sequence fragments. VFR can create the dynamic ACLs necessary to protect against fragment attacks

The VFR status field shows the status of VFR on an interface. If VFR is enabled on the interface, the column displays On. If VFR is disabled on the interface, the column displays Off.

The Edit IPS tab also contains buttons that enable you to configure and manage Cisco IOS IPS policies, security messages, signatures, and more.

Use the show ip ips configuration command to display additional configuration data that is not displayed with the show running-config command. Example 6-2 shows some sample output from the show ip ips configuration command.

Example 6-2. show ip ips configuration Command Output

Router# show ip ips configuration
IPS Signature File Configuration Status
    Configured Config Locations: flash:/ipsdir/
    Last signature default load time: 04:39:33 UTC Dec 14 2007
    Last signature delta load time: -none-
    Last event action (SEAP) load time: -none-

    General SEAP Config:
    Global Deny Timeout: 3600 seconds
    Global Overrides Status: Enabled
    Global Filters Status: Enabled

IPS Auto Update is not currently configured

IPS Syslog and SDEE Notification Status
    Event notification through syslog is enabled
    Event notification through SDEE is enabled

IPS Signature Status
    Total Active Signatures: 353
    Total Inactive Signatures: 1783

IPS Packet Scanning and Interface Status
    IPS Rule Configuration
      IPS name sdm_ips_rule
    IPS fail closed is disabled
    IPS deny-action ips-interface is false
    Fastpath ips is enabled
    Quick run mode is enabled
    Interface Configuration
      Interface FastEthernet0/0
        Inbound IPS rule is sdm_ips_rule
        Outgoing IPS rule is not set
      Interface FastEthernet0/1
        Inbound IPS rule is sdm_ips_rule
        Outgoing IPS rule is not set

IPS Category CLI Configuration:
    Category all:
        Retire: True
    Category ios_ips basic:
        Retire: False
    Category ios_ips:
        Enable: True
    Category ios_ips advanced:
       Enable: True

Use the show ip ips interface command to display interface configuration data. Example 6-3 displays output from the show ip ips interface command, revealing that the inbound IPS audit rule sdm_ips_rule is applied to FastEthernet 0/0 and FastEthernet 0/1. There is no rule applied for outgoing traffic on either interface.

Example 6-3. show ip ips interface Command Output

Router# show ip ips interfaces
Interface Configuration
      Interface FastEthernet0/0
        Inbound IPS rule is sdm_ips_rule
        Outgoing IPS rule is not set
      Interface FastEthernet0/1
        Inbound IPS rule is sdm_ips_rule
       Outgoing IPS rule is not set

Use the show ip ips all command to display additional configuration data that is not displayed with the show ip ips configuration command.

In Example 6-4, the output from the show ip ips all command shows that syslog and SDEE notification is enabled, and that there are 693 active signatures and 1443 inactive signatures on the router.

Example 6-4. show ip ips all Command Output

Router# show ip ips all
IPS Signature File Configuration Status
    Configured Config Locations: flash:ipsstore/
    Last signature default load time: 00:25:35 UTC Dec 6 2007
    Last signature delta load time: -none-
    Last event action (SEAP) load time: -none-

    General SEAP Config:
    Global Deny Timeout: 3600 seconds
    Global Overrides Status: Enabled
    Global Filters Status: Enabled

IPS Auto Update is not currently configured

IPS Syslog and SDEE Notification Status
    Event notification through syslog is enabled
    Event notification through SDEE is enabled

IPS Signature Status
    Total Active Signatures: 693
    Total Inactive Signatures: 1443

IPS Packet Scanning and Interface Status
    IPS Rule Configuration
      IPS name myips
    IPS fail closed is disabled
    IPS deny-action ips-interface is false
    Fastpath ips is enabled
    Quick run mode is enabled
    Interface Configuration
      Interface FastEthernet0/1
        Inbound IPS rule is not set
        Outgoing IPS rule is myips

IPS Category CLI is not configured

IPS Category CLI is not configured