How to upgrade IPS Signature

Can anyone help me with the steps of upgrading the IPS signature for the platform ASA SSM-20, IDS 4215, WV-SVC-IDSM-2 via IDM and IME. All the sensors are already upgraded with Engine E4 with signature S480.
Can I upgrade the signature directly from S480 to S507? Please let me know the file which I need to download. Is there any impact while updating the signture like reboot?

Hi Gangadaran,
We can apply the same package on all the mentioned platforms. It can be applied to all below platforms:
- IPS-42xx Cisco Intrusion Prevention System (IPS) sensors
- IDS-42xx Cisco Intrusion Detection System (IDS) sensors (except the IDS-4220, and IDS-4230)
- WS-SVC-IDSM2 series Intrusion Detection System Module (IDSM2)
- NM-CIDS IDS Network Module for Cisco 26xx, 3680, and 37xx Router Families.
- ASA-SSM-10 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- ASA-SSM-20 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- ASA-SSM-40 Cisco ASA Advanced Inspection and Prevention Security Services Module (Requires ASA)
- AIM-IPS Cisco Advanced Integration Module for ISR Routers
Refer the readme for all details:
http://www.cisco.com/web/software/282549755/37074/IPS-sig-S507.readme.txt
All the best!!
Thanks,
Prapanch

Similar Messages

How to convert Cisco IPS signatures to a MARS events - no keyword search

I am trying to run a scheduled report looking for the new Microsoft exploit under the IPS S411 release, SIGID 19339.0 and I am trying to form the query looking for the event this falls under without using a keyword search on the SIGID. Does anyone know how to correlate an IPS signature to a MARS event?
Thanks,
Mike

With the help of On-box local event correlation technology you can correlate. On-box local event correlation technology not only enables detection, but actually blocks multi-event attacks and malware in real time, complementing security incident management software such as the Cisco Security Monitoring, Analysis, and Reporting System (Cisco Security MARS) that correlate events across multiple devices.
Integrates with the Cisco Security Manager to correlate security events with the configured firewall rules and intrusion prevention system (IPS) signatures that can affect the security event

Mars box MARS box v4.3.5 (2838) IPS Signature Version 330 upgrade

Hi, I have the software MARS box v4.3.5 (2838) IPS Signature Version 330
Is there any upgrade available for it?
Where can I found info for upgarding the software and IPS Signature on Cisco Web Site?
I also want to integrate CiscoWorks, LMS 2.6 to sent SNMP Trap Notification to the MARS box v4.3.5 (2838) IPS Signature Version 330. Is it possible and what would be the port # on the MARS box?

You are already running the latest software for the Generation 1 MARS appliances. You can find newer updates here:
http://www.cisco.com/cgi-bin/tablebuild.pl/cs-mars
For IPS, it is better to turn on automatic updates. Just go to:
Admin >> System Setup >> IPS Signature Dynamic Update Settings
The URL is already set there, just put your CCO username/password and click 'Update Now' then hit 'Submit'. I think the current Signature release is 352. You can manually downlaod them from here if you like:
http://www.cisco.com/cgi-bin/tablebuild.pl/mars-ips-sigup
Please rate if helpful.
Regards
Farrukh

How to smartnet to update IPS signature

I just get the Smartnet contract number from my vendor. But i am not sure how to use to update my IPS signature.
Can anyone please point out?
Regards, CT

I had this same problem when trying to drag and drop an RSS feed gadget to a dashboard. I was able to get it to work by clicking the add button instead of doing a drag and drop. It still displays the error but it adds the gadget. Once the gadget has been added to the dashboard you can modify it by clicking the wrench icon.

IPS Signature Knowledge

Hi Cisco,
How we can see the detail of the Cisco IPS signature. If i want to see the the prriority(High/Medium/Low) of latest signature.
E.g if i upgrade my IPS sensor with Latest signature and i want to see what are the High or critical signature Cisco updated in
this signature then what is the process to check this or where?
Kind Regards,
Salman Ahmed

You can check the release notes/read me file on the version that you upgrade it to, and it will advise if there is any changes to the existing signature.

IPS Signature Detail

Hi Cisco,
How we can see the detail of the Cisco IPS signature. If i want to see the the prriority(High/Medium/Low) of latest signature.
E.g if i upgrade my IPS sensor with Latest signature and i want to see what are the High or critical signature Cisco updated in
this signature then what is the process to check this or where?
Kind Regards,
Salman Ahmed

You can check the release notes/read me file on the version that you upgrade it to, and it will advise if there is any changes to the existing signature.

Is it really possible to revert IPS signatures from CSM

Hi folks,
I've been trying to revert IPS signatures that I deployed through CSM Signature policies to the older release but it doesn't seem to be working. Contrary to it Cisco's CSM guide says:
If you later decide that you did not want to apply a signature update, you can revert to the
previous update level by selecting the Signatures policy on the device, clicking the View
Update Level button, and clicking Revert
I can't imagine it is possible as the signatures are normally compiled into xml files. How would the sensor do it ?
Eugene

During installation a copy of files that will be replaced or updated during the installation will be copied into a backup directory.
The CLI has a "downgrade" command that can uninstall the last update, and the backup copies will be used to replace the files being removed.
A few things to be aware of:
1) Old configuration will be copied back. So changes made since the update may be lost.
2) This works only for Engine Updates and Signature Updates. Major Updates, Minor Updates, and Service Packs replace the complete operating system so there is too much data to try and make backup copies for.
3) This works only for the last update installed. Once you've downgraded the latest one, you can't downgrade the previous one.
4) This can be done through CLI, and now also available in CSM.
Here are some things to check in your situation where it appears to not be working.
Login to the sensor and execute "show ver".
Does the history in the "show ver" output show a Signature Update package as the last update installed?
If not then either another downgrade was previously done, or a Major Update, Minor Update, or Service Pack was the last package installed and can't be downgraded.
If it can't be done through CSM you might try the CLI' "downgrade" command and see if it works through the CLI or if the CLI gives you an error and explanation.

How to get digital signature for Google Map geocoding V3 in PL/SQL?

Hi, Gurus:
    Could anyone provide me an example about how to generate digital signature for Google Maps service v3 in PL/SQL? We tried to upgrade our program using Google maps service from v2 to v3. We are using PL/SQl on background to send request to Google for geocoding. We found some sample code to register with digital signature, but none of them is based on PL/SQl. Notice I used Google business client ID "gme-XXX" and wallet.
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
Google Maps API - more URL signing samples
Here is my code for V2. I notice in order to get signature, I need to use HMAC-SHA1 algorithm.
procedure Get_Geocoding(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
l_address varchar2(4000);
l_url varchar2(32000);
l_response varchar2(3200);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
l_address := replace(l_address,' ','+');
l_url := 'http://maps.google.com/maps/geo?q='||l_address||'&'||'output=csv'||'&'||'client=gme-XXX';
l_response := utl_http.request(l_url, APEX_APPLICATION.G_PROXY_SERVER, '/u02/app/oracle/admin/apexsb/wallet', 'XXXXXXXX');
n_level_length:=0;
n_first_comma:=instr(l_response,',',1,1);
n_second_comma:=instr(l_response,',',1,2);
n_level_length:=n_second_comma-n_first_comma-1;
P_n_accuracy:=0;
if n_level_length>0 then
P_n_accuracy:=to_number(substr(l_response,n_first_comma+1, n_level_length));
end if;
l_response:=substr(l_response,instr(l_response,',',1,2)+1);
--dbms_output.put_line('In function: l_response ='||l_response);
P_s_Geocoding:=l_response;
if (P_s_Geocoding<>'0,0') then
P_b_success:=true;
--dbms_output.put_line('true');
else
P_b_success:=false;
--dbms_output.put_line('false');
end if;
END;
Thanks!

Hi, guys:
    I tried to generate digital signature for Google map service
     Maps for Business: Generating Valid Signatures - YouTube
    Generating an HMAC-SHA-1 Signature Using Only PL/SQL
      OAuth and the PL/SQL | Data Warehouse in the Cloud
   but I got error message from Google:
Unable to authenticate the request. Provided 'signature' is not valid for the provided client ID. Learn more: https://developers.google.com/maps/documentation/business/webservices/auth
   I think there is something wrong with my code to generate signature, as if I remove the part regarding client and signature, it will work, can anyone help me on this problem?
/*Procedure Get_Geocoding is used to get geocoding with accuracy level for V3 business account, you can find Google map digital signature descrirption from
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
if geocoding is 0,0, procedure returns false to indicate failure of get geocoding*/
procedure Get_Geocoding2(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
--private key for Google business account, this is provided by Google with client name.
l_private_key_src varchar2(200):='xxxxxxxxxxxxxxxxxxx';
l_private_key_b64_alter varchar2(200):= translate(l_private_key_src,'-_','+/');
l_private_key_bin raw(2000);
l_client_name varchar2(100):='gme-xxx';
l_signature_mac raw(2000);
l_signature_b64 varchar2(200);
l_signature_b64_alter_back varchar2(200);
l_Google_service_domain varchar2(200):='http://maps.googleapis.com';
l_address varchar2(4000);
l_url varchar2(32000);
l_path varchar2(32000);
l_response varchar2(32000);
l_page UTL_HTTP.HTML_PIECES;
n_actual_length number;
json_obj json;
json_tempobj json;
jl_listOfValues json_list;
json_geom_obj json;
json_loc json;
l_lat VARCHAR2(40);
l_lng VARCHAR2(40);
l_status VARCHAR2(255);
json_accuracy json;
--temp_string varchar2(10000);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_private_key_bin := utl_encode.base64_decode(UTL_I18N.string_to_raw(l_private_key_b64_alter, 'AL32UTF8'));
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
--dbms_output.put_line(l_address);
l_address := replace(l_address,' ','+');
l_path := '/maps/api/geocode/json?address='||l_address||'&'||'sensor=true';
dbms_output.put_line(l_path);
l_signature_mac :=DBMS_CRYPTO.mac(UTL_I18N.string_to_raw(l_path, 'AL32UTF8'), DBMS_CRYPTO.hmac_sh1,l_private_key_bin);
l_signature_b64:= UTL_RAW.cast_to_varchar2(UTL_ENCODE.base64_encode(l_signature_mac));
l_signature_b64_alter_back:=translate(l_signature_b64,'+/','-_');
dbms_output.put_line(l_signature_b64_alter_back);
--get response from Google map service
l_url:=l_Google_service_domain||l_path||'&client='||l_client_name||'&signature='||l_signature_b64_alter_back;
--l_url:=l_Google_service_domain||l_path;
dbms_output.put_line(l_url);
l_page:=utl_http.request_pieces( l_url, 99999);
for i in 1..l_page.count loop
l_response:=l_response||l_page(i);
end loop;
n_actual_length:=length(l_response);
dbms_output.put_line(n_actual_length);
dbms_output.put_line(l_response);
--parse JSON result
json_obj:=new json(l_response);
l_status := json_ext.get_string(json_obj, 'status');
IF l_status = 'OK' then
jl_listOfValues := json_list(json_obj.get('results'));
json_tempobj := json(jl_listOfValues.get(1));
json_geom_obj := json(json_tempobj.get(3));
json_loc := json_ext.get_json(json_geom_obj, 'location');
l_lat := to_char(json_ext.get_number(json_loc, 'lat'));
l_lng := to_char(json_ext.get_number(json_loc, 'lng'));
P_s_Geocoding:=l_lat||','||l_lng;
dbms_output.put_line('##########'||P_s_Geocoding);
case json_ext.get_string(json_geom_obj, 'location_type')
when 'ROOFTOP' then P_n_accuracy:=9;
when 'RANGE_INTERPOLATED' then P_n_accuracy:=7;
when 'GEOMETRIC_CENTER' then P_n_accuracy:=5;
else P_n_accuracy:=3;
end case;
P_b_success:=true;
else
P_b_success:=false;
P_n_accuracy:=0;
P_s_Geocoding:='0,0';
end if;
END;

Correct procedure to update IOS IPS signatures on 2911 router

What is the correct procedure to update the IOS IPS signatures on an 2911 router?
I know how to download the signatures file (eg. IOS-S556-CLI.pkg) but what is the correct way to install the update?
Thank you in advance!

The IPS signature package comes with a list of pre-enabled signatures, hence Cisco does not recommend enabling a lot more other signatures, especially not every single signature as documented.
The reason why is because the package might include retired/old signatures only for references, and not every single signature is required to protect your environment because you might not have the traffic for some signatures, you might not have some end hosts that are written with specific signatures, therefore, it becomes irrelevant if you enable it.
Typically here is how customer would enable/disable signatures:
- Use the default signature that is enabled by Cisco (the default should fit majority of the customers).
- Monitor it for a couple of months
- Disable those that you don't need, and enable others if you think you require it for specific.

Where do IPS signature save at?

Hi
i successfully load the IOS IPS package into the router, verify via CLI and CCP the IPS signature did compile on the router. (advanced mode, around 588 signature is active)
but it went gone (happened twice), i just want to ensure few things
1. i did shut down my router, and migrate to production site, would it cause by the power off / on then IPS signature missing?
2. i did remove the "ip ips iosips in/out" command that previous apply at my interface, would this cause the IPS disable and gone?
just counldn't figure out why now my router only have 3 signature only..
thanks

1. Please use the doc below for reference on how to configure IOS-IPS on the router. I will try to answer your questions using this document.
http://tools.cisco.com/squish/9Be6a
2. You will see in step 2.1 we create directory on flash to store all the signature files and configurations.
e.g:
mkdir
router#mkdir ips
Create directory filename [ips]
Created dir flash:ips
3. In step 4.2 , we configure IPS signature storage location by referencing the directory we created above.
e.g:
ip ips config location flash:
router(config)#ip ips config location flash:ips
This is where the signature files will be stored.
4. In step 5.1 we copy the signature files to the router.
e.g:
router#copy ftp://cisco:[email protected]/IOS-S310-CLI.pkg idconf
Loading IOS-S310-CLI.pkg !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 7608873/4096 bytes]
The idconf command compiles the signature after the file is copied.
5. If all the above steps are done correctly, you should see the following files in flash:
router#dir ips
Directory of flash:/ips/
7 -rw- 203419 Feb 14 2008 16:45:24 -08:00 router-sigdef-default.xml <----Contains factory default signature definitions.
8 -rw- 271 Feb 14 2008 16:43:36 -08:00 router-sigdef-delta.xml
9 -rw- 6159 Feb 14 2008 16:44:24 -08:00 router-sigdef-typedef.xml
10 -rw- 22873 Feb 14 2008 16:44:26 -08:00 router-sigdef-category.xml
11 -rw- 257 Feb 14 2008 16:43:36 -08:00 router-seap-delta.xml
12 -rw- 491 Feb 14 2008 16:43:36 -08:00 router-seap-typedef.xml
64016384 bytes total (12693504 bytes free)
6. Make sure you do a 'Router#write memory' before you reload the router. This way the configuration done gets stored and is preserved after reboot.
Also make sure your configuration register on the router is correctly set to 0x2102.
Sid Chandrachud
TAC security solutions

IOS IPS Signature-File

Hi Guys,
We have recently purchased a Cisco ISR 2921, and on its docs it is writen that this product has a License for IOS IPS Signatrue File, but on the product Flash Memory there is no IOS IPS Sig-File.   and while i try to download the sig-file from Cisco, it fails.
Can any one tell me where is an alternate way to download the sig-file ?

900 active signatures is quite much for a system that has no dedicated IPS-ressources.
But you can controll which and how many signatures get enabled on your router:
In the following example I first disable all signatures and enable the ones for web-servers. So just decide which signatures you need. But don't forget to monitor your router-ressources.
gw#conf t
Enter configuration commands, one per line. End with CNTL/Z.
gw(config)#ip ips signature-category
gw(config-ips-category)#?
IPS signature category configuration commands:
category Category keyword
exit      Exit from Category Mode
no        Negate or set default values of a command
gw(config-ips-category)#category ?
adware/spyware                Adware/Spyware (more sub-categories)
all                           All Categories
attack                        Attack (more sub-categories)
configurations                Configurations (more sub-categories)
ddos                          DDoS (more sub-categories)
dos                           DoS (more sub-categories)
email                         Email (more sub-categories)
instant_messaging             Instant Messaging (more sub-categories)
ios_ips                       IOS IPS (more sub-categories)
l2/l3/l4_protocol             L2/L3/L4 Protocol (more sub-categories)
network_services              Network Services (more sub-categories)
os                            OS (more sub-categories)
other_services                Other Services (more sub-categories)
p2p                           P2P (more sub-categories)
reconnaissance                Reconnaissance (more sub-categories)
releases                      Releases (more sub-categories)
specially_licensed_signature Specially Licensed Signature (more sub-categories)
telepresence                  TelePresence (more sub-categories)
uc_protection                 UC Protection (more sub-categories)
viruses/worms/trojans         Viruses/Worms/Trojans (more sub-categories)
web_server                    Web Server (more sub-categories)
gw(config-ips-category)#category all
gw(config-ips-category-action)#retire true
gw(config-ips-category-action)#exit
gw(config-ips-category)#category web_server
gw(config-ips-category-action)#?
Category Options for configuration:
alert-severity   Alarm Severity Rating
enabled          Enable Category Signatures
event-action     Action
exit             Exit from Category Actions Mode
fidelity-rating Signature Fidelity Rating
no               Negate or set default values of a command
retired          Retire Category Signatures
gw(config-ips-category-action)#retired false
gw(config-ips-category-action)#exit
gw(config-ips-category)#exit
Do you want to accept these changes? [confirm]
gw(config)#
gw(config)#exit
gw#sh ip ips configuration | s IPS Signature Status
IPS Signature Status
    Total Active Signatures: 131
    Total Inactive Signatures: 4370
gw#
I didn't follow the thread and answered your first post to have less line-breaks in this post.

IOS IPS Signature Updates

Hi,
Is it possible to update signatures for IOS IPS or do we need to update the IOS to get more signatures?
Thanks and rgds
Rajesh

hi,
if you have cisco sdm, then it would be easy to update your IOS IPS signatures. You may need to upgrade IOS of the router only when the ips signature requires you to do it.

How the upgrade to Creative Cloud happens when you are already a signed member of Typekit?

Hello everybody. I have a signature for Typekit. When I purchase a Creative Cloud the price I had payed is discounted? How the upgrade to Creative Cloud happens when you are already a signed member of Typekit?
Thanks

Hi rogeriovelloso,
This page explains how your Typekit account may change if you sign up for a Creative Cloud subscription:
http://help.typekit.com/customer/portal/articles/529513-link-an-existing-typekit-account-t o-a-new-creative-cloud-subscription
Please let me know if you have any other questions, here or at [email protected]! Best,
-- liz
Typekit Support

How to Upgrade RPM without checking dependicies.

Hi
I have some RPM installed on RHEL4. for installing i need to upgrade some RPMs. I am using the command RPM -Uvh <RPM name> to upgrade RPMs. Some time i get error that
[root@R11 RPM]# rpm -Uvhf gcc-3.4.6-3.i386.rpm
warning: gcc-3.4.6-3.i386.rpm: V3 DSA signature: NOKEY, key ID 0c98ff9d
error: Failed dependencies:
cpp = 3.4.6-3 is needed by gcc-3.4.6-3.i386
gcc = 3.4.3-9.EL4 is needed by (installed) gcc-c++-3.4.3-9.EL4.i386
gcc = 3.4.3-9.EL4 is needed by (installed) gcc-g77-3.4.3-9.EL4.i386
gcc = 3.4.3-9.EL4 is needed by (installed) gcc-gnat-3.4.3-9.EL4.i386
gcc = 3.4.3-9.EL4 is needed by (installed) gcc-java-3.4.3-9.EL4.i386
gcc = 3.4.3-9.EL4 is needed by (installed) gcc-objc-3.4.3-9.EL4.i386
[root@R11 RPM]#
Kindly inform me how to upgrade RPMs' without checking the dependencies.
Thanks
Krishna

Package dependencies exist to stop you from jeopardizing proper functions of your system. There is probably a good reason for this, but if you want to go ahead regardless then try the --nodeps parameter. The error is telling you that you need to install cpp-3.4.6-3.i386.rpm.

How to configure IPS 4240 - K9 to send log file to syslog server

I am looking for the commands in how to configure IPS 4240-k9 to send log file to SYSLOG server. If anybody has or came across similer issue please advice.
Thanks in advanced.

Ali -
I am sorry to tell you, but the Cisco IPS Sensors do not send Syslog messages. Your only options for sending signature event information are:
SDEE (an TLS Encrypted XML formatted message) the sensor is the SDEE Host and your event receiver (MARS, IME, Intelitactics, etc) is the client.
SNMP Traps - You need to set the "Action" on each signature you want the sensor to send a trap.
- Bob

How to upgrade IPS Signature

Similar Messages

Maybe you are looking for