1841 IOS IPS online updates

Hi,
Can we configure 1841 IOS IPS to get automatic signature updates directly from cisco site. I know we can do it in other firewalls like sonicwall, fortigate, etc.
Regards
Siva K

Hi Siva,
Yes you can do it from the Cisco Security Manager , or you can try
Automatic Signature Update Guidelines
When enabling automatic signature updates, it is recommended that you ensure
the following configuration guidelines have been met:
* The router's clock is set up with the proper relative time.
*The frequency for Cisco IOS IPS to obtain updated signature information has
been defined.
*The URL in which to retrieve the Cisco IOS IPS signature configuration files
has been specified.
*Optionally, the username and password for which to access the files from the
server have been specified.
SUMMARY STEPS
1. enable
2. configure terminal
3. ip ips auto-update
4. occur-at min:hour date day
5. username name password password
6. url url
7. exit
8. show ip ips auto-update
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ips5_sig_fs_ue_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1079125
regards
Yesua

Similar Messages

IOS IPS Sig Updates

It seems like whenever there is an IDS sensor/appliance update for defending against the latest virus/worm but there is no update for IOS IPS signatures.
Case in point - on June 3 there was an IDS update for W32/Bobax.worm.o S174. The IOS IPS zip file as of today is S169 from May 25, What gives?
Also, why isn't their any release notes for the IOS IPS zip files to document what was added? That way we can read it to judge if we need to download the zip file or not.

There are a couple of extra steps in producing the IOS IPS signature update. The IOS IPS solution is a subset of the full appliance solution and is further constrained by memory limitations inherent in the routers that it runs in. Because of this, once the signature development team puts together an appliance update, that update has to be reviewed to make sure that the appliance signatures won't crash the IOS implementation. Any issues found during the review have to be addressed before the IOS update can be posted. This extra review step is the cause for the delay.
Regarding the release notes. The signatures usable by the IOS solution are a subset of the appliance update. You can look at the appliance update release notes to see what *might* be available. I say might because of the subset issues....
SC

IOS IPS SIG Updates via IDSMDC

When using IDSMSC to push out updates for Sensors and IOS IPS devices, the signature update process pushes the updates to the sensors during the udate process. However the IOS IPS devices pulls their signature definitions from the server itself.
So my question is, do you need to "Generate" and "Deploy" to all IOS IPS devices to insure the devices are updated with the latest signature definitions after the update?
SHM

There are a couple of extra steps in producing the IOS IPS signature update. The IOS IPS solution is a subset of the full appliance solution and is further constrained by memory limitations inherent in the routers that it runs in. Because of this, once the signature development team puts together an appliance update, that update has to be reviewed to make sure that the appliance signatures won't crash the IOS implementation. Any issues found during the review have to be addressed before the IOS update can be posted. This extra review step is the cause for the delay.
Regarding the release notes. The signatures usable by the IOS solution are a subset of the appliance update. You can look at the appliance update release notes to see what *might* be available. I say might because of the subset issues....
SC

Is there a way to automate IOS IPS signature updates without CSM?

I have a growing number of 891 routers running IOS IDS/IPS. My Cisco vendor has stated repeatedly that CSM is the only way to manage signature updates to multiple routers, but I'm finding CSM to be incredibly tedious and slow. It also wants to manage a lot more than just the IPS policies and signatures which causes other problems.
I have about 160 routers deployed now and that will grow to at least 600. I have CSM 3.3.1. I'm told 4.x would make it easier becasue it can be configured to ignore more of the non-IPS bits of the router configs, but the upgrade is a big chunk of money that wouldn't be in the budget until at least 2012.
Is anybody doing this with an expect script or EEM applets or something else? It seems to me that I could manually upload an update to one router and push the resulting XML files to all the other routers a lot easier and faster than I could "discover" a bunch of routers in CSM (and rediscover them every time we make a CLI change), add the routers to a group, apply updates to a sig policy, lather, rinse, repeat..., not to mention troubleshooting the weird errors and completely wron "warnings" that CSM spews.
Thanks in advance!

From IOS version 15.1(1)T, you can configure the IOS IPS to auto update from cisco.com which would help I believe.
Here is the configuration guide for your reference:
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ips5_sig_fs_ue_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1138659

IOS IPS auto-update

Hi,
I have a couple of questions I hope people could answer:
1) What recommendations/options are available for downloading signature files to a HTTP/TFTP server prior to having the IOS IPS device pull them from the server? Is their a way to automate the HTTP/TFTP server downloading the signatures? (Cron job or such)
2) Does the signature file name change each time a new signature file is released? If it does, would I have to go back to the router to update the URL string that is configured in the ip ips auto-update section? I would hate to have to update 200 CPE devices each time a new signature file is released.
Hoping someone could answer these or help point me in the right direction to find the answer out.
regards M

I found this link with answers my one question.
Cisco IOS Intrusion Prevention System (IPS)
Tuning, Deploying and Updating Cisco IOS IPS Signature Sets For Multiple-Device Deployments
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6634/white_paper_c11_549300.html

IOS IPS Signature Updates

Hi,
Is it possible to update signatures for IOS IPS or do we need to update the IOS to get more signatures?
Thanks and rgds
Rajesh

hi,
if you have cisco sdm, then it would be easy to update your IOS IPS signatures. You may need to upgrade IOS of the router only when the ips signature requires you to do it.

IOS IPS auto-update without CSM

Hi,
We have 400 x 1811 router on which we need to update the IPS signature definition and custom signature.
What is the best way to do it withou running CSM ?
According to Cisco documentation, we need to add the auto-update command with an .XML extention. But when we load a .pkg in a router, the output is 4 different files. Unfortunalty we can auto-update only one file. Which one to I need to load on our TFTP server ?
All the exemples of Cisco are using one single XML file.
Does a single file with the signature defenition, category, default and type exist ?
Since all our router have the same IPS config, I tought I could use one router at the central office with the configuration we want. And by someway asking the remote routers to auto-update their XML file on that router on which I would have activated a TFTP server.
Anyone ever had to upgrade a lot of router IOS IPS signature?

This can now be done in the 15.1T branch using cisco.com to download the update directly, see :
http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151TNEWF.html#wp1040750
http://www.cisco.com/en/US/docs/ios/sec_data_plane/configuration/guide/sec_ips5_sig_fs_ue.html#wp1137583

IPS signature update

i would like to get some idea for IOS IPS signature update.
example currently the router fresh install using IOS-S416-CLI.pkg, IOS category ios_ips in advanced mode, with retired false.
Just wonder what if next time download and loading with latest patch of the IOS-SXXX-CLI.pkg into the machine, what will effect on the current compiled signature?
will it just loaded in incremental form? (meaning is it the signature in latest patch will added as new enable signature), then what about the signature previously being modified and save one, any effect on it? (like re-write my previous save signature)
with the new patch install, would it also effect on the router DRAM and flash size? (my router with 384 mb DRAM and 128mb flash)
thanks

Hi,
When you compile a new signature package on a router that carries an existing signature database, the signature configuration in the new signature package will supersede the router's existing database's signature configuration. Thus, if you have made changes to the signature database on the your router, and you compile in an updated signature package that contradicts your changes, your changes will be overwritten!!, and will need to be re-created.
You can avoid having to re-create your changes if you copy the "routername-sigdef-delta.xml" or "iosips-sigdef-delta.xmz" file to some other location on the router's local storage, and re-apply the original "routername-sigdef-delta.xml" or "iosips-sigdef-delta.xmz" to the updated signature database after you have compiled the updated signature package to the router's database.
And don't forget, the basic signature category is appropriate for routers with less than 128 MB of flash memory, and the advanced signature category is appropriate for routers with more than 128 MB of flash memory.
Hope this helps,
Thank You,

Correct procedure to update IOS IPS signatures on 2911 router

What is the correct procedure to update the IOS IPS signatures on an 2911 router?
I know how to download the signatures file (eg. IOS-S556-CLI.pkg) but what is the correct way to install the update?
Thank you in advance!

The IPS signature package comes with a list of pre-enabled signatures, hence Cisco does not recommend enabling a lot more other signatures, especially not every single signature as documented.
The reason why is because the package might include retired/old signatures only for references, and not every single signature is required to protect your environment because you might not have the traffic for some signatures, you might not have some end hosts that are written with specific signatures, therefore, it becomes irrelevant if you enable it.
Typically here is how customer would enable/disable signatures:
- Use the default signature that is enabled by Cisco (the default should fit majority of the customers).
- Monitor it for a couple of months
- Disable those that you don't need, and enable others if you think you require it for specific.

IOS IPS Important Notice - UPDATED

IOS IPS customers running version 12.4T, 15.0M, or 15.1M - a critical software defect has been identified which may cause your router to reload and be stuck in a boot loop if IOS IPS signature version S639 or later is installed on the device. Recovery of impacted devices is possible only via a serial console connection through the device's ROMMON mode. For customers who are using IOS IPS signatures S638 or earlier, there is no issue. Customers wishing to upgrade the IOS IPS signature version to S639 or later must first be running a fixed version of IOS on the device prior to upgrading the IPS signatures. Fixed versions of IOS include: 15.2(4)M, 15.1(3)T4, 15.2(3)T1, 15.1(4)M5, 12.4(24)T8 and later. Please refer to defect CSCtz27137 for additional details and steps to recover impacted devices.
If you have upgraded your version of IOS to 15.2(4)M, 15.1(3)T4, 15.2(3)T1, 15.1(4)M5, 12.4(24)T8 or later you can obtain the most recent signature updates by contacting the Cisco TAC

What is the most recent version of IOS IPS sig file that TAC can supply?
I'm running IOS 15.2(4)M1 and, per your suggestion above to contact TAC for the most recent signature update, I requested a later version of IPS sig than S636.
I was simply referred back to the standard download page and IPS sig file S636.

IOS IPS Automatic Signature Update

I will use cisco1941w.
I'd like to know, how to configure at CLI and where is the URL.
Is the bellow correct?
CLI
Router(config)# ip ips auto-update
Router(config-ips-auto-update)# occur-at 0 0-23 1-31 1-5
Router(config-ips-auto-update)# url https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl
Router(config-ips-auto-update)# username XXX password XXX
URL
https://www.cisco.com/cgi-bin/front.x/ida/locator/locator.pl

Hello,
A. Hete is what the six files do:
• ios-ips-sigdef-default.xml: contains all the factory default signature definitions
• ios-ips-sigdef-delta.xml: contains signature definitions that have been changed from the default
• ios-ips-sigdef-typedef.xml: is a file that has all the signature parameter definitions
• ios-ips-sigdef-category.xml: has all the signature category information, such as category ios_ips basic and advanced
• ios-ips-seap-delta.xml: contains changes made to the default SEAP parameters
• ios-ips-seap-typedef.xml: contains all the SEAP parameter definitions
B. So the signature file (.pkg) is decompressed into these files and then 'idconf' loads them in memory.
Hence to copy signature database of one router to the other, we need to copy atleast first 4 files.
You only need to distribute the SEAP configuration if you modified any of the Signature Event Action Override configuration:
We do not have one single file that contains all the signatures. The signature package is installed in a certain way.
Hence we will need atleast first 4 files to copy of signature database from one router to the other.
C. Secondly, I dont know if auto-update will accept a file in .xmz package, I have not tested this.
But I am guessing it will look for a .pkg file and decompress it.
With copying a .xmz file, you may have to manually load it into memory using 'idconf' command.
D. Hence there is no one single configuration file that you copy off the external ftp server.
I guess, the only thing you can do is to have different routers update signatures at different times to reduce load on the network.
It is also not necessary to check for signature updates every hour.
Normal rate of adding new signature releases is every few days, so even if you check around once a day that should be ok.
Sid Chandrachud
TAC Security Solutions
Customer support engineer

IOS 7.1 update problem. Wifi disabled, no longer works. Disappointed with apple response

I have several IOS devices and updated each of them to Apple's release of IOS 7.1.
Unfortunately my iPhone 4s did not update successfully. It was affected by the widely reported issue regarding WiFi being disabled permanently. After the update to IOS 7.1, wifi is no longer an accessible option on the IPhone 4s.
After doing some online research and identifying this as a common problem, I tried some of the suggestions available online such as resetting settings and restoring from backup. None of these suggestions worked.
I brought the iPhone 4s to the apple store at the Rideau Center in Ottawa, Ontario, Canada and spoke to one of the employees. He stated that it was not an apple issue and that it was a problem with my phone that would cost $200 to resolve. He said that it was not a problem related to the ios 7.1 update and that it was a "coincidence" that it happened at the same time as the update to ios 7. 1 and was probably an issue with the wifi chip.
It is surprising to me that applying an update recommended by apple and using the iPhone 4s in the manner in which it was designed (using wifi) would cause this basic function (wifi) to cease to function.
Wifi is an essential part of my day to day use of this device. I am appalled that apple is denying the problem and has no resolution for it.
If anyone else this problem, please go to your nearest apple store and let this forum know your experience in getting the issue resolved.

Somewhere in there, is there a question for us, your fellow users in these user to user support forums?

IOS IPS and VMS and shunning

Installed 12.3.14T2 (advanced security) on 2811 router with new
VMS update to the IDS Management Center (2.1) to support IOS IPS SDEE event monitoring. When I configure a specific signature, there is no option to shun. Only alert, block or reset. Where do you configure the dynamic shuning or "local shun action" that seems to be in all the "new features" of the IOS IPS.
Configuring the signature to block, alert or reset works fine. Just no options to shun. Also the IPS device does not show up in the device list under Monitoring on VMS, even though it shows up as a device in Monitoring Center Device Page.
Maybe this is where the problem may lie.

IOS versions before 12.3(14)T support the following
actions for IOS IPS:
- alarm
- drop (drop just the offending packet)
- reset (reset tcp connection - works for tcp only)
Version 12.3(14)T and later (including 12.4 versions) added support for the "local shunning" through two different actions:
- denyFlowInline
- denyAttackerInline
DenyFlowInline creates an ACL that drops all traffic on that connection for a certain idle-timeout.
DenyAttackerInline creates an ACL that drops all traffic from that source address (including other connections from that source address) for a certain idle-timeout.

IOS IPS license

Does anyone know if I need to buy a license for the IPS signature update of IOS routers. Thanks,

Yes. You need to buy a license for the IPS signature update of IOS routers. For direct purchases this is included in SmartNet contract price for a given router.
Partners can also purchase Cisco Services for IPS contract (signature update license) separately.
Kemal Akozer
IOS IPS Product Manager

2651XM IPS Signature Update?

Hello,
I have a 2651XM 256MB/32MB running 12.4(25) and I would like to update the IPS signature file. I see that the last update for 256MB.sdf was from Aug 2008. The latest IPS I found is IPS-sig-S518-req-E4.pkg from
http://tools.cisco.com/support/downloads/go/PlatformList.x?sftType=Intrusion+Prevention+System+%28IPS%29+Signature+Updates&mdfid=277801011&treeName=Security&mdfLevel=Model&url=null&modelName=Cisco+2651XM+Multiservice+Router&isPlatform=N&treeMdfId=268438162&modifmdfid=278279418&imname=Cisco+IDS+Access+Router+Network+Module&hybrid=Y&imst=Y
I've tried the command
ip ips sdf location flash:\\IPS-sig-S518-req-E4.pkg
ip ips sdf location flash:IPS-sig-S518-req-E4.pkg
but when I apply IPS to an interface and run 'show ip ips all' no signatures load and I get a message 'invalid token'.
I also tried seeing if the latest SDM will help but nothing.
My question is, what is it that I am doing wrong or missing? Is my router too old to be able to get the latest signature files?
Any advice or guidance to the right direction is much appreciated.
Thanks

You have a version of IOS that includes the older version of the IOS IPS feature (referred to as v4). This release only supports signature updates using the SDF formatted files. These files are no longer updated.
The signature update file you found (ending in .pkg) is the signature update package supported by Cisco's IPS appliances and is not compatible with the IOS IPS feature set.
The current IOS IPS feature (referred to as v5) also makes use of .pkg files. You will need to upgrade the IOS of your 2651 to a release in the T train such as 12.4(24)T2 to obtain the latest IOS IPS feature release.
You can find out more about the IOS IPS feature set here:
http://www.cisco.com/go/iosips
For starting with IOS IPS v5:
http://www.cisco.com/en/US/products/ps6634/products_tech_note09186a008097db66.shtml
Scott

1841 IOS IPS online updates

Similar Messages

Maybe you are looking for