Cisco IOS based IPS Services Licensing Query

Hi Experts,
We have a Cisco 3945 router at one of our location. Our requirement is to enable the IOS based IPS engine within in the router and would like to load new signature files from cisco website to the router. But i am not much familiar with the licensing part. show version and show ip ips license output has been attached for the reference. Following are my queries.
1) Is this platform and IOS is capable for enabling IPS Engine?
2) Is there any extra IPS Services Contract is required (other than the smartnet Coverage) for this router to enable IPS engine and to load new IPS Signature files from Cisco?
Advanced Thanks and Regards,
Sihanu N

1) Is this platform and IOS is capable for enabling IPS Engine?
Yes, it is (3945 with a security IOS image will be able to do it)
2)Is there any extra IPS Services Contract is required (other than the smartnet Coverage) for this router to enable IPS engine and to load new IPS Signature files from Cisco?
No, you are good to go.
I will write a future articule about how to enable this feature on an IOS router so stay tune in my website at http:laguiadelnetworking.com for further information as I will cover all of the details,
Cheers,
Julio Carvajal Segura

Similar Messages

IOS Based IPS -- No Alerts??

We are trying to setup a 2811 router to run IOS based IPS. We followed all the procedures but we can't seem to get the system to send any alerts via syslog. We have tried various port scanners with no luck. Are we missing something?

Here is the IOS version:
Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Experimental Version 12.4(20070215:163920) [jenneyc-V124_11_T1 107]
Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Sun 11-Mar-07 12:16 by jenneyc
Also, this is the only message we got that might be considered a IDS alert. But we don't get any alerts when we perform normal port scans.
<188>2459: Apr 10 15:04:47.885: %IPS-4-SIGNATURE: Sig:2157 Subsig:1 Sev:75 [10.15.250.30:0 -> 10.11.100.61:0] RiskRating:63
rtrwan-anf000#sho ip ips configuration
Configured Config Locations: flash:ips5/
Last signature default load time: 16:57:56 est Mar 14 2007
Last signature delta load time: 12:03:57 est Apr 10 2007
Last event action (SEAP) load time: -none-
General SEAP Config:
Global Deny Timeout: 3600 seconds
Global Overrides Status: Enabled
Global Filters Status: Enabled
IPS Auto Update is not currently configured
IPS fail closed is disabled
Fastpath ips is enabled
Quick run mode is enabled
Event notification through syslog is enabled
Event notification through SDEE is disabled
Total Active Signatures: 1090
Total Inactive Signatures: 899
IPS Rule Configuration
IPS name testips
IPS Category CLI Configuration:
Category all:
Retire: False
Category viruses/worms/trojans all-viruses/worms/trojans:
Retire: False
Category p2p bittorrent:
Retire: False
Category p2p edonkey:
Retire: False
Category p2p kazaa:
Retire: False
Category reconnaissance:
Retire: False Alert
Interface Configuration
Interface FastEthernet0/0.1
Inbound IPS rule is testips
Outgoing IPS rule is testips
Interface FastEthernet0/0.2
Inbound IPS rule is testips
Outgoing IPS rule is testips
Interface Serial0/0/0
Inbound IPS rule is testips
Outgoing IPS rule is testips
Interface Serial0/0/0.34
Inbound IPS rule is testips
Outgoing IPS rule is testips
Interface Serial0/0/0.35
Inbound IPS rule is testips
Outgoing IPS rule is testips

IOS-based IPS on router

Hello everyone,
My router specification is,
C7200P-IPBASE-M, IOS version 12.4(15)T17
I found that 12.4(15)T4 and later supports IOS-based IPS.
But my resellter said to me that
C7200P-IPBASE-M does not show valid for smartnet.
May someone update me how I can have IOS-based IPS on my router?
Thanks,

I got the answer from Cisco.
7201 router is end of life so that it does NOT support this feature.

IPS Signature License

Dears,
I would like to know if we have the smartnet of Cisco ASA with AIP-SSM module, Does cisco also includes IPS signature license along with the smartnet or is it seperately we have to buy?
Thanks & Regards,
Jvalin

Well purchasing is not an issue here. The contract with the buying vendor states only buying and not support and the contact with support vendor is only support not buying.
So If we buy "Cisco Services for IPS" which covers smartnet (support) as well as signature license it contradicts the above agreement done between the three.
The only solution is see here is to buy devices from the 1st vendor and buy only signature licenses from the 1st vendor whereas enrol only for smartnet of asa/aip-ssm from the 2nd vendor.
1st vendor says - regular signature updates comes under support and not buying.
2nd vendor says - regular signature updates should be bought from the 1st vendor as they are only for suppor of the hardware.

Cisco IOS IPS in Cisco 2921/k9 router

Hi All,
I have a router of Cisco 2921 series (C2921/K9) basic box with IP BAse IOS image (SL-29-IPB-K9 IOS). I would like to enable IOS Level IPS feature on this Router now. Based on the Cisco Document i have found i need to purchase an additonal subscripton license to enale the IPS feature. My querry is-
Will it support on the Basic IP Base IOS or do i need to change the IOS?
If i need to purchase the Subscription Licesne, how can i get the part number and cost for the same?
Do i need to buy any addtional module for this like (NME-IPS-K9) ?
Thanks in advance for your quick support
regards
Sunny

Hi Sunny
1. Yes you can enable IPS on IOS with the security license, without buying a subscription, but this would make little sense - new signatures are being released all the time so you would not be protected from recently discovered vulnerabilities/attacks.
2. Correct, the modules and appliances run a different kind of software and are much more powerful
3. If you add the module, you do NOT need the security license. It would still be advised to get a subscription license to get signature updates for the module.
I hope this helps, let us know.
regards
Herbert
jacob.samuel wrote:Dear Herbert,Thanks alot for the wonderful post. It clear most of my doubts. Still i kindly need to know few more points-1) Cant we enable IPS Feature on 2921/K9 router (with Sec license or 2921Sec/K9 bundle) without signature subscription license (is it a must? it is for getting updates of signatures and for support only, right?)2) I came to know from a distributor pre-sales engineer that the Cisco IOS Level Intrusion Protection is not going to provide the full feature of IPS like NME module or IPS Applinace. Is that right?3) If i add NME-IPS-K9 Module to my 2921 Router, without enabling Sec License, can i enable IPS feature on the Router. Or is it a must that i need to buy Sec License (SL-29-SEC-K9)?Attaching the Datasheet of NME-IPS-K9 module (Page num 5 above Table 3) mentione as follows-Cisco IOS Software Feature Sets and ReleaseTable 3 lists the required Cisco IOS feature sets and releases for Cisco IPS AIM and IPS NME on the Cisco 1841,
2800 and 3800 series Integrated Services Routers Note that, IPS NME on the Cisco 2900 and 3900 Integrated
Services Routers does not require a Security Feature license.
In that case if i buy a module i can install it on the 2921K9 box directly and can enable the IPS feature right? I dont need any License and additonal signature subscription here to enable the IPS feature (if i dont need signature updates and support) right?
thanks alot for the support.
regards
Sunny

Cisco IOS IPS on 2811

Hi,
Is it possible to install NM-CIDS-K9 Intrusion module on a Cisco 2811 and run IPS 5.0 on it ? i.e. with similar functionality to a IPS 4200 series appliance.
From what i understand that you can do the above but the module will only work as IDS and not as in-line IPS (ability to drop packets etc) ?
Are there any routers that can have a Network module running in IPS mode to provide the same functionality as IPS appliance (4200 etc) ?
Is it correct that IOS IPS is only a fraction of the appliance based IPS ?
Regards \\ Naman

I am not really sure if there are any routers that can have a Network module running in IPS mode to provide the same functionality as IPS appliance as such, but the module will only work as IDS and not as in-line IPS

ISE 1.1.3 en Cisco IOS SCEP

Hi,
I'm running Cisco ISE 1.1.3.124 and a Cisco IOS 2811 (c2800nm-spservicesk9-mz.150-1.M2.bin) which I configured the be a SCEP server.
PKI Authentication and enrollment of a Cisco switch with this SCEP server is running well but BYOD clients enrollment via EAP-TLS (1024/2048) giving me the following error on the Cisco IOS SCEP server:
SCEP#
.Mar 17 15:21:59.446: Sun, 17 Mar 2013 15:21:59 GMT 10.0.0.164 /cgi-bin/pkiclient.exe ok
        Protocol = HTTP/1.1 Method = GET Query = operation=PKIOperation&message=MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgU
AMIAGCSqGSIb3DQEHAaCAJIAEggPoMIAGCSqGSIb3DQEHA6CAMIACAQAxggEvMIIBKwIBADATMA4xDDAKBgNVBAMTA2lzZQIBA
TANBgkqhkiG9w0BAQEFAASCAQAmbK6WZ5L6gw+uh7h4Qi53XL76QsBNcY8E6cMxWDp8hWbLvujNOylSvJLF
.Mar 17 15:21:59.446:
.Mar 17 15:21:59.454: CRYPTO_CS: received a SCEP request, 3652 bytes
.Mar 17 15:21:59.454: CRYPTO_CS: read SCEP: registered and bound service SCEP_READ_DB_10
.Mar 17 15:21:59.482: CRYPTO_CS: scep msg type - 19
.Mar 17 15:21:59.482: CRYPTO_CS: trans id - 9871e81c65121310b77df8b341c7c887a5392da2
.Mar 17 15:21:59.486: CRYPTO_CS: failed to open env data
.Mar 17 15:21:59.486: CRYPTO_CS: read SCEP: unregistered and unbound service SCEP_READ_DB_10
.Mar 17 15:21:59.486: CRYPTO_CS: failed to read SCEP request
.Mar 17 15:21:59.502: Sun, 17 Mar 2013 15:21:59 GMT 10.0.0.164 /cgi-bin/pkiclient.exe ok
SCEP#
I'm stuck now on the message: failed to open env data. So can anyone explain what the meaning is of this message or maybe know if IOS SCEP with ISE is supported ?
Thanks in advance.
greetz Michel
btw the tracelog of the switch enrollment with IOS SCEP is below:
SCEP#
.Mar 17 14:57:10.932: Sun, 17 Mar 2013 14:57:10 GMT 10.0.0.161 /cgi-bin/pkiclient.exe ok
        Protocol = HTTP/1.0 Method = GET Query = operation=PKIOperation&message=MIIGWgYJKoZIhvcNAQcCoIIGSzCCBkcCAQExCzAJBgUrDgMCGgUAMIIDAAYJKoZI
hvcNAQcBoIIC8QSCAu0wggLpBgkqhkiG9w0BBwOgggLaMIIC1gIBADGBujCBtwIB
ADAgMBsxGTAXBgNVBAMTEGNhLndlc3R3aWp6ZXIubmwCAQEwDQYJKoZIhvcNAQEB
BQAEgYAo/LNaINm+tcgzF8V8d7d5x
.Mar 17 14:57:10.932:
.Mar 17 14:57:10.936: CRYPTO_CS: received a SCEP request, 2210 bytes
.Mar 17 14:57:10.940: CRYPTO_CS: read SCEP: registered and bound service SCEP_READ_DB_1
.Mar 17 14:57:10.948: CRYPTO_CS: scep msg type - 19
.Mar 17 14:57:10.948: CRYPTO_CS: trans id - 59D142A6D0F525668626A435229BAAF1
.Mar 17 14:57:11.040: CRYPTO_CS: read SCEP: unregistered and unbound service SCEP_READ_DB_1
.Mar 17 14:57:11.040: CRYPTO_CS: received an enrollment request
.Mar 17 14:57:11.040: CRYPTO_PKI: creating trustpoint clone ise1
.Mar 17 14:57:11.040: CRYPTO_CS: checking policy for enrollment request ID=1
.Mar 17 14:57:11.040: CRYPTO_CS: request has been authorized, transaction id=59D142A6D0F525668626A435229BAAF1
.Mar 17 14:57:11.040: CRYPTO_CS: locking the CS
.Mar 17 14:57:11.040: CRYPTO_CS: added CDP extension
.Mar 17 14:57:11.044: CRYPTO_CS: added key usage extension
.Mar 17 14:57:11.044: CRYPTO_CS: Validity: 13:57:11 UTC Mar 17 2013-13:57:11 UTC Oct 3 2013
.Mar 17 14:57:11.128: CRYPTO_CS: writing serial number 0x2.
.Mar 17 14:57:11.180: CRYPTO_CS: file opened: nvram:ise.ser
.Mar 17 14:57:11.180: CRYPTO_CS: Writing 32 bytes to ser file
.Mar 17 14:57:13.864: CRYPTO_CS: reqID=1 granted, fingerprint=2
.Mar 17 14:57:13.864: CRYPTO_CS: unlocking the CS
.Mar 17 14:57:13.864: CRYPTO_CS: write SCEP: registered and bound service SCEP_WRTE_DB_1
.Mar 17 14:57:13.984: CRYPTO_CS: write SCEP: unregistered and unbound service SCEP_WRTE_DB_1
.Mar 17 14:57:13.988: CRYPTO_CS: Certificate generated and sent to requestor
.Mar 17 14:57:13.988: CRYPTO_CS: removing trustpoint clone ise1

Michel,
Officially supported it is not:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCud86973
Some people mentioned varios degrees of "having it working".
In your case it's the envelope data which appears to be a problem for IOS.
M.

Cisco IOS SLB or CSM?

I am trying to inform myself if Cisco IOS supports Server Load Balancing (SLB) without the CSM. It appears this software has been integrated into a hardware module known as a Content Switching Module. (CSM)
Aside from cost and being a hardware module (faster) in a IOS based Catalyst 6500, Is there a functional advantage / disadvantage of using the Cisco CSM over Cisco IOS Server Load Balancing or vice versa. Any comments would be appreciated. Thanks.
Mark

IOS SLB shares the same software code base as Cisco IOS and has all the software features sets of Cisco IOS software. IOS SLB is recommended for customers desiring complete integration of SLB technology into traditional Cisco switches and routers.
The CSM is specifically designed to meet the demands of large Internet service providers (ISPs), Co-location facilities, Application service providers (ASPs), and Enterprise web server farms.
These links might help you gain a better understanding:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121newft/121limit/121e/121e8/iosslb8e.htm#xtocid32
http://www.cisco.com/en/US/partner/products/hw/modules/ps2706/products_qanda_item09186a0080092384.shtml
http://www.cisco.com/warp/customer/cc/pd/si/casi/ca6000/prodlit/ccsm_ds.htm

Catalyst c3750g Cisco IOS 12.2 (25) SEE2 support SSH

I need some help configuring SSH on a 48 port Switch Cisco WS-C3750G-48TS that is running Cisco IOS 12.2(25) SEE2.
I have attempted to set it up, but I had no luck. If anyone can give me any assistance to this let me know.

Hi Mike
Based on your existing IOS level (iP Base/IP services/Adv IP services) you should upgrade your switch to one of the IOS versions given below, to have SSH:
c3750-ipbasek9-mz.12.2-52.SE - min flash 16, DRAM 128
c3750-ipservicesk9-mz.12.2-52.SE - min flash 16, DRAM 128
c3750-advipservicesk9-mz.12.2-46.SE - min flash 16, DRAM 128
Once you have your IOS upgraded, define hostname, domain name, crypto rsa key, and transport input commands on the switch to have it converted to SSH..
Hope this helps.. All the best
Raj

Cisco IOS IP SLAs Operations in IOS 15.2E

Hi,
does anybody know the required license for 3560-x in IOS 15.2E fo use of IP SLA.
Cisco feature Navigator does not know yet, configuration guide says at least IP Services license needed, switch CLI permits configuration with LAN Base License.
So what ?
br Fritz

Hey Stefan,
I believe its a good candidate for a TAC case.
HTH.
Regards,
RS.

Cisco IOS CA using 3rd Party Certificate

Hi,
Can I use 3rd Party certificate such as verisign, on Cisco IOS CA ? All i can see on cisco.com is self-signed certificate from router.
Thanks
-santo-

Santo,
That's fair enough. A key information to make sure customers understand that a private PKI infrustructure is (for the purpose of deployment such as GETVPN) as secure as provided by third part party.
Private PKI is not based on self signed certificates - only the root CA might need something like it :-)
That being said, for reliability and flexability I really suggest storing CA (ser, CRL, OCSP, backup of public/private keys) files on storage external to the router.
Key takeway is that a properly managed private PKI solution for deployments like DMVPN/GETVPN others is as secure as external 3rd party services (and often time order of magnitude cheaper).
M.

What is the minimal reqs to use Host-based IPS?

I have several servers touching the internet, and one basic ASA-5510.
Aside from purchasing the AIP-SSM and upgrading the 5510 license, what else is required to have a host-based IPS?
Do I need to purchase MARS or other software?
How are the security-agents spec'ed?
Thanks.

This is what Cisco is saying to that topic (from the EOL-page):
Cisco's network security product portfolio has complementary security technologies, such as Cisco Intrusion Prevention Systems,Cisco ASA 5500 Series Adaptive Security Appliances, and Cisco IronPort Email and Web gateways. Please contact your Cisco account team for more information on these products. While there is no direct Cisco Security Agent replacement product from Cisco, many endpoint security products are available from a wide variety of third-party vendors. We expect that customers will want to do their own due diligence in choosing a replacement product that best meets their needs.
For Clients I would go for the typical security-packages every anti-virus-vendor has to offer. In addition with a web-filter the protection should be quite good. For Servers, network-based IPS together with filtering reverse-proxys and application-gateways do the work for me. But I really miss the CSA in some cases.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Publish action not working with JCA based Business Service

Hi All,
I have created one BS in OSB that publish the message in AQ. Its working fine as expected when tested from test console.
I have made one proxy service which after transformation will publish the message to this BS, but the publish action is not invoking.
I have added log action inside request action of my publish action and log is getting generated for that with correct request.However, I cant see message in DB neither can i see any exception/error logs in OSB.
I tried replacing publish with route action and its working fine , message is getting published in AQ.Did any one face this type of issue before ???
Or publish action works only with jms based Business services.
Appreciate your help.
Regards,
Karan

Bingo !!!
Setting QOS helped me to find out the exact error. Was passing complete soap envelope to BS instead of passing body part only.
Thanks a lot for your help mate .
One more query can you please enlighten me on the use of QOS in OSB, such as in what scenarios we should use QOS.
Regards,
Karan
Edited by: Karan Mann on Mar 14, 2013 3:37 AM

Cisco ISE Enpoint Protection Services (EPS)

Hi
I've got a question of understanding to the Cisco ISE (Endpoint Protection Services).
I am looking for an Integrity check for client systems. I have read of EPS.
Is EPS for checking the Integrity of client systems or only to block client by her IP or Mac? I found some instructions for configuring EPS, but never a server is specified, which verifies the integrity (eg, Microsoft WSUS, Avira ...). Can someone explain the exact use of EPS?
Thanks for any help.
Marco

What you are looking for is the posture-service which tests the clients for integrity/compliane based on your policy.
And you are right, the EPS in ISE is more a tool to assist you to efficently block systems that you found to be malicious for example.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Service Offering, Query Results question.

Hi,
I got a question about the Service Offering, Query Results criteria page.
As shown in the Picture below i have a Query based on the Active Directory User Class.
The background is that i got alot of accounts more than 2000. The token "String" is used to narrow down the search. I also got some accounts that i dont want to show in the portal for the end users (The ones who
ends with "Z" in the pager).
Generally i would say that the "OR" would be "AND" (due to it is an logical operator, i want both conditions to be true) between the two UserPager properties, but i havent found any way to change that. I suspect that it is not possible
to change "OR" to "AND" when making criterias against the same values more than 1 time.
The Query below will return all accounts under that Distinguished name, even if i wrote something in the String prompt. Removing the Criteria Pager ends on "Z" makes the String prompt work. But it will not exclude those objects ending with
Z. Is this a normal behavior or am i thinking/doing sometime wrong?

This is how all criterias work in service manager. If the same property is included more than once it puts an OR inbetween. You would have to export the MP that contains the query result and edit the criteria manually to AND.
Cheers,
Anders Spælling
Senior Consultant
Blog:
Twitter: LinkedIn:
Please remember to 'Propose as answer' if you find a reply helpful

Cisco IOS based IPS Services Licensing Query

Similar Messages

Maybe you are looking for