Cisco IPS 4200 Series Feature

Does the Cisco IPS 4200 can support RADIUS for user authentication?
Does the Cisco IPS 4200 can support SYSLOG for sending logging to outside?

Are you kidding me? Then how do you explain
the fact that security devices such as
checkpoint and ASA firewalls are allowed
authentication via tacacs/radius and you can
send syslog back to a syslog server. Normally
the information is got sent back via the
Command and Control (C&C) interface which
should be on a secure network in the first
place.
This is a limitation of the of the IDS itself.
I have not tried version 5.x or 6.x yet but
if they are similar to version 4.1, then
they are nothing but a Linux box. You can
"shell" into the box and install PAM on it
so that you can use external authentication
such as radius/tacacs or even LDAP.

Similar Messages

I'm looking for Failover/High available solutions for IPS 4200 Series

Hi all,
I tried to find out Failover/High available solutions for IPS 4200 series,I didn't saw failover solutions in IPS guide document. Anybody can be help me!

I do not know if this is documented anywhere, but I can tell you what I do. As long as the IPS 4200 has power, with the right software settings, the unit can fail such that it will pass traffic. Should the unit loose power, it does stop all traffic. I run a patch cable in parallel with the in line IPS unit, in the same VLAN, with a higher STP cost. Thus all traffic will traverse the IPS unit when possible, but should something happen to it, a $10 patch cable takes over.
Mike

Cisco ips 4200 - errsystemerror-ct-sensorapp.443 not responding

Hi team,
Does anyone have come across the below error while accessing the cisco ips 4200 running with 7.0 version. The Gui closes automatically after this message.
errsystemerror-ct-sensorapp.443 not responding, clientpipe failed.
regards()

Problem resolved by rebooting the device.. It is documented in cisco.
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_qanda_item09186a008025c533.shtml
When I attempt to log in to IPS, I receive this error message:
errSystemError-ct-sensorAPP.450 not responding, clientpipe failed
. How can I resolve this error?
A. In order to resolve this error, use the reset command in order to reboot the IPS.
Rate of this was helpful...

CIsco IPS 4200 Log Fields

Hi,
Could anyone please tell me where can I find the information regarding the Fields of the log for IPS 4200? In what sequence do they appear in log files and what does each field signify?
Basically, I need the layout of the log file for the IPS logs. e.g. a sample layout would be something like this:
[timestamp] , [signatureID] , [vendor] [signature desc], [attacker IP] , [victim IP] , [attack type] , [action ID] , [action desc]
Thanks.
Regards,
Pratik

Here's an example of an SDEE message. I believe this is from a version 5.x sensor (it could be version 4, I don't see Risk Rating). Each time a new major version of software is release, new features are added and (if reportable) they show up as new fields in the SDEE messages.
testsensor4250XL
sensorApp
440
Sdee
10.1.1.119
1180958240541285000
10.1.1.119
0
1
R0VUIC9vc3Mvc3VydmV5LmFzcD7pdW1kYXlzPTUrMyBIVFRQ0=
11.1.1.2
60556
61.1.1.76
80

IPS 4200 Series

Hello Dears,
I have fresh installed IPS 4200 in Inline interface pair mode, Uptill now i m not getting any packet drops or complains from users.
What else to be done to configure IPS as a Professional setup for corporate Network.
Thanks

Now the hard work begins.
Performing analysis on all medium and high severity signatures and performing these actions:
Tuning the signatures - Recurring false positive signatures that fire should be adjusted down in severity of disabled (if completely useless)
- Turning on packet captures to learn more about why a signature is fireing and help your analysis.
Remediation - Once you've found an infected host inside your network, clean it.
- If the attack is from outside your network, discover how it is getting in and modify the means of access (Firewall, VPN, etc) to prevent future attack vectors.
This should be plenty to get you started and keep you busy. Don't forget to rinse and repeat.
- Bob

Cisco IPS Concurrent session support in ips 4260 and 4270 sensor

I am wondring that no document from Cisco IPS data sheets mention the concurrent session support in Cisco IPS 4200 series sensor. I am looking forward to any one who can advise about the subject.
Thanks
Nouman

Hi.
with IPS devices it's difficult to measure performance by # of connections per second since several factors count to the performance limit, including:
1- packet size.
2- object sizes per transaction
3- transactions per second
4- signatures enabled
5- features enabled
that why public documents try to make it more realistic by mentioning the transactional performance.
here is a link mentioning concurrent connections for 4270:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd806e7283.html
although the link mentiones 100k and 200k, but we've seen situations where we had a lot more connections with a smaller amount of signatures enabled.
for the 4260 the public document only mentions the transactional performance.
Regards,
Fadi.
If this answers your question please mark the thread as resolved.

IPS 4200 Signature & Action IDs

I need a reference manual for the list of all the signatures and actions supported by Cisco IPS 4200 series appliances with software version 6.x.
I have tried locating this through the IPS product page but had no luck yet.
Please let me know where can I find this reference manual.
Thanks.

Have you looked at the security center?
http://tools.cisco.com/security/center/search.x?search=Signature
Regards
Farrukh

Does Cisco IPS appliance 4200 and 4300 series have whitelist?

Hi all,
I am wondering if I can do whitelist on the Cisco IPS appliance itself. I understand for IPS module in ASA it is possible...hope anyone can enlighten me.
Cyrus

Cyrus,
It kinda does, it is called Event action filters, where you can excempt host/subnets for triggering certain signatures.
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.html
Whatever you put on them, wont trigger the signatures you dont want it to trigger.
Hope it helps.
Mike

IPS SSP module vs standalone 4200 series devices

Looking at price to performance ratio it seems that the IPS SSP modules are the winner.
The 4200 series devices however has hardware bypass which can ensure traffic flow is not interrupted even if the power to the IPS goes down. How likely is it that a malfunction of the IPS SSP affects the work of the ASA?
We are looking at ASA5585X S20 with IPS SSP S20 or same ASA with IPS 4260.
Any and all input in terms of pros and cons you are aware of will be appreciated.

Yes, you can have the IDSM2 module in your CAT 6K. However, please check how much traffic will be traversing the IDSM2 module since you mention internal as well as traffic towards the internet. Please ensure that the performance of the internal traffic is not impacted. Also depends on whether you will be configuring the IPS in promiscuous or inline mode.
Here is the datasheet for IDSM2:
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_data_sheet09186a00801e55dd.html
You might even want to bundle a few IDSM2:
http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps5058/product_data_sheet0900aecd804b91d7.html
Hope that helps.

4200 series IPS & GNU Bash issue

any idea when we will see an update for cisco-sa-20140926-bash (GNU bash issue) for the 4200 series IPS appliances?

Do the logs show anything useful when the freeze occurs?

Will IDS v4.1 software run on the IPS-4200 appliances?

I understand that Cisco IPS 5.0 software will run on the IDS-4200 series appliances (e.g. - IDS -4235).
Is the reverse true? Can I get Cisco IDS 4.1 to run on an IPS-4240 or an IPS-4255?
Just curious, since I may have to answer the question internally soon...
Thanks in advance,
Alex Arndt

Just an FYI the only Appliances/Modules that support 5.0 that do not support 4.1 are the ASA-SSM-AIP-10 and ASA-SSM-AIP-20.
These 2 modules are brand new and will only support the 5.0 version.
To read more about the 2 new modules refer to:
http://www.cisco.com/en/US/products/ps6120/products_data_sheet0900aecd802930c5.html

Cisco Aironet 1300 Series Power

Can the 1310ap receive it's power from a POE switch?

Hi Edward,
Sadly the 1310 cannot be powered by PoE ,but, the Power Injector can be up to 100 meters away from the unit.
Dual coaxial cable to run from the power injector to the 1300. See attached notes:
Cisco Aironet 1300 Series
Cisco Aironet 1300 Series Access Point/Bridge Power Injector
The Cisco Aironet 1300 Series Outdoor Access Point/Bridge Power Injector,converts the standard 10/100 BaseT Ethernet interface that is suitable for weather protected areas to a dual F-Type connector interface for coax cables that are more suitable for harsh outdoor environments. The Power Injector also provides power to the outdoor unit over the same cables with a power discover feature and surge protection. To support longer cable runs from your wireless network switch or router, the Power Injector LR is designed to accommodate up to a 100 meter coaxial cable run plus 100 meters of indoor cat5 cable?enabling total cable runs up to 200 meters. The Cisco Aironet 1300 Series Outdoor Access Point/Bridge ships with the Power Injector LR2 and an AC power supply.
From this link:
http://www.cisco.com/en/US/products/ps5861/products_data_sheet09186a008022551d.html
Cisco Aironet 1300 Series Outdoor Access Point/Bridge Hardware Installation Guide
Ethernet Ports
The access point/bridge dual-coax Ethernet ports consists of a pair of 75-ohm F-type connectors, linking the unit to your 100BASE-T Ethernet LAN through the power injector. The dual-coax cables are used to send and receive Ethernet data and to supply inline 48-VDC power from the power injector to the access point/bridge.
Power
The access point/bridge receives inline power from the Cisco Aironet Power Injector (hereafter called the power injector). Dual-coax cables are used to provide Ethernet data and power from the power injector to the access point/bridge. The power injector is an external unit designed for operation in a sheltered environment, such as inside a building or vehicle. The power injector also functions as an Ethernet repeater by connecting to a Category 5 LAN backbone and using the dual-coax cable interface to the access point/bridge.
AIR-PWRINJ-BLR2
F-Type Connectors
Dual coaxial cable carries full-duplex Ethernet, DC power, and full-duplex console port (RS-232 connection)
From this link:
http://www.cisco.com/en/US/products/ps5861/products_data_sheet09186a00802252e1.html
Hope this helps!
Rob

Hi Friends,help in purchasing new cisco IPS

Hi Friends,
                I am working as a network admin in a telecom based company and we have two lease
                line of of 2mb and 1 mb bandwidth resp.I have a cisco asa 5510 and i want to purchase a cisco IPS.
                I am very fresh to this security field so pls kindly suggest me which series of
                cisco IPS is suitable for my comp network.
Any kind of help is appreciated.
                                                  Thankx a lot in advance.

Hii Arghadip,
i have given my friend user id,i checked in workplace,it was not ther friend...how can i rectify this problem..
awaiting for your reply buddy.
Regards
Raju Aitha

Cisco IPS Tech Tips: Data Center Protections and Platforms

Hello Cisco Community Forum Members;
Robert Albach invites you to attend a 30-45 minute Web seminar on the Cisco   IPS internal operations using WebEx. This event requires registration.
Topic: Cisco IPS Tech Tips - Data Center Protections and Platforms
Host: Robert Albach
Date and Time:
Thursday, July 19, 2012 10:00 am, Central Daylight Time (Chicago, GMT-05:00)
To register for the online event
1. Go to https://cisco.webex.com/ciscosales/onstage/g.php?d=206048546&t=a&EA=ralbach%40cisco.com&ET=ade69a0aa29f279471b6a85feae46a71&ETR=5b39cf5f535442c1763f090845d7ddd3&RT=MiM3&p
2. Click "Register".
3. On the registration form, enter your information and then click   "Submit".
Once the host approves your registration, you will receive a confirmation   email message with instructions on how to join the event.
For assistance
http://www.webex.com
IMPORTANT NOTICE: This WebEx service includes a feature that allows audio and   any documents and other materials exchanged or viewed during the session to   be recorded. By joining this session, you automatically consent to such   recordings. If you do not consent to the recording, discuss your concerns   with the meeting host prior to the start of the recording or do not join the   session. Please note that any such recordings may be subject to discovery in   the event of litigation.

The recordings and the presentation slides are placed here on the Cisco Support Community. I think if you roll the threads back some you will see the prior month's Tech Tips (then called Tech Talks) posted.
This one will be posted a few days after the event.
-Robert

Evaluating cisco IPS AIP-SSM-10 allong side Tipping Point S330

Hello all,
What are your thoughts on this matter? I am also going to be looking at the Palo Alto solution for IPS as well.
I'm probably going to use the cisco 4200 sensors if they offer multi segment like the tipping point does.
I'm looking at protecting the perimiter but NOT replacing my current firewall. The current firewall is the Microsoft TMG.
I like what I see on the Cisco IPS express. I've also looked at the CSM for management. It seems that Cisco is a lot more flexible when it comes to editing and managing the signatures.
ARe there similar experiences out there that you would like to share?
Thanks!
Kurt

Both products are pretty strong. But Tipping point have a much more comprehensive, promptly updated, and a well managed signature base. Both products can monitor multiple segements (terminologies are different).
A good way to compare is to subsribe to their IPS signature updates and see the difference, I mean both from Cisco and DV labs
BR
Farrukh

Cisco IPS 4200 Series Feature

Similar Messages

Maybe you are looking for