IOS IPS Signature-File

Question

Hi Guys,
We have recently purchased a Cisco ISR 2921,  and on its docs it is writen that this product has a License for IOS IPS Signatrue File,  but on the product Flash Memory there is no  IOS IPS Sig-File.   and while i try to download the sig-file from Cisco, it fails.
Can any one tell me where is an alternate way to download the sig-file ?

Answer 1

900 active signatures is quite much for a system that has no dedicated IPS-ressources.
But you can controll which and how many signatures get enabled on your router:
In the following example I first disable all signatures and enable the ones for web-servers. So just decide which signatures you need. But don't forget to monitor your router-ressources.
gw#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
gw(config)#ip ips signature-category
gw(config-ips-category)#?
IPS signature category configuration commands:
  category  Category keyword
  exit      Exit from Category Mode
  no        Negate or set default values of a command
gw(config-ips-category)#category ?
  adware/spyware                Adware/Spyware (more sub-categories)
  all                           All Categories
  attack                        Attack (more sub-categories)
  configurations                Configurations (more sub-categories)
  ddos                          DDoS (more sub-categories)
  dos                           DoS (more sub-categories)
  email                         Email (more sub-categories)
  instant_messaging             Instant Messaging (more sub-categories)
  ios_ips                       IOS IPS (more sub-categories)
  l2/l3/l4_protocol             L2/L3/L4 Protocol (more sub-categories)
  network_services              Network Services (more sub-categories)
  os                            OS (more sub-categories)
  other_services                Other Services (more sub-categories)
  p2p                           P2P (more sub-categories)
  reconnaissance                Reconnaissance (more sub-categories)
  releases                      Releases (more sub-categories)
  specially_licensed_signature  Specially Licensed Signature (more sub-categories)
  telepresence                  TelePresence (more sub-categories)
  uc_protection                 UC Protection (more sub-categories)
  viruses/worms/trojans         Viruses/Worms/Trojans (more sub-categories)
  web_server                    Web Server (more sub-categories)
gw(config-ips-category)#category all
gw(config-ips-category-action)#retire true
gw(config-ips-category-action)#exit              
gw(config-ips-category)#category web_server
gw(config-ips-category-action)#?
Category Options for configuration:
  alert-severity   Alarm Severity Rating
  enabled          Enable Category Signatures
  event-action     Action
  exit             Exit from Category Actions Mode
  fidelity-rating  Signature Fidelity Rating
  no               Negate or set default values of a command
  retired          Retire Category Signatures
gw(config-ips-category-action)#retired false
gw(config-ips-category-action)#exit
gw(config-ips-category)#exit
Do you want to accept these changes? [confirm]
gw(config)#
gw(config)#exit
gw#sh ip ips configuration | s IPS Signature Status
IPS Signature Status
    Total Active Signatures: 131
    Total Inactive Signatures: 4370
gw#
I didn't follow the thread and answered your first post to have less line-breaks in this post.