IPS router 3900

hi, i need help..., is that the IPS in Cisco 3900 series routers is integrated on IOS or it's still a module.

Hi ,
Its support both IPS module and cisco IOS IPS , but IOS module has got limited function
Look into below link for more information
http://www.cisco.com/c/en/us/products/collateral/routers/1841-integrated-services-router-isr/prod_qas0900aecd806c4e3c.html
What are the differences between the Cisco IPS modules and Cisco IOS IPS?
A. Following are some of the major differences between the Cisco IPS AIM and IPS NME and Cisco IOS IPS:
• Cisco IPS AIM and IPS NME have dedicated CPU and DRAM to offload IPS processing, whereas Cisco IOS IPS shares router resources with other processes.
• Cisco IPS AIM and IPS NME support both inline and promiscuous mode, whereas Cisco IOS IPS supports only inline mode.
• Cisco IPS AIM and IPS NME can support all Cisco IPS signatures that are not retired by default, whereas Cisco IOS IPS can support only a user configurable subset.
• Cisco IPS AIM and IPS NME run Linux-based Cisco IPS Sensor Software, whereas Cisco IOS IPS runs a Cisco IOS Software-based IPS code.
HTH
Sandy

Similar Messages

CSM3.1 device addition of IOS IPS router

Upon adding a IOS IPS device running (C2800NM-ADVIPSERVICESK9-M,Version 12.4(15)T1,)& 5.x-303 release signatures, CSM 3.1 does not display it as an IPS enabled device. The device in question (2821) has a stand-alone config and 5.x advanced signatures functioning properly.
In the device properties of CSM 3.1 of said 2821, IPS is a feature but is grayed out. I have successfully added 2 ADSM modules from our 6513's and it displays them as IPS devices and I can add/deploy signatures to these devices. However, CSM 3.1 does not recognize the 2821 as an IOS IPS device and I can not add/deploy to this device. What am I missing here?

In this case you will need to create a new device in CSM (using the Add Device option) and discover the device for the IOS IPS policies to show up. Just doing a rediscovery of an existing IOS device will not show the IOS IPS policies. This is because CSM treats the IOS IPS device as a different target type than a IOS device.

Site-to-site ASA and Router IOS

Hi everyone! I am trying to connect a site-to-site between an ASA and a router 3900 series. My question is what should I have to configure in the router site to protect my LAN from any external attack?
Thanks

Check the below posting...
https://supportforums.cisco.com/thread/70943
Also, make sure to allow site-to-site tunnel related ports from ASA IP only.
hth
MS

(VPN) There is no internet after connection established.

Hi Guys,
Mission: PC-1 in country X would like to use the internet(browsing, using his IP-->) of PC-2 in country Y.
Stage: on PC-2 i created "new incoming connection trough the internet" (VPN server) and on PC-1 i set up VPN client with (PPTP). The connection was established, i could browse even shared folder between PC-1 to PC-2,
BUT: on PC-1 after connected to VPN there was no internet, only file shareing, could not ping the PC-2 Ip, only the PC-2's VPN server. i spent hours checking settings, playing with IPs, route tables, but nothing worked.
i need assistant, what i did forgot or how can i accomplish my mission other way.
P.S in many cases i saw people on Client (PC-1) only unchecked "Use default gateway on remote network".. yes but than its use PC-1 ISP's internet.. but thats what i dont want .. i want to use PC-2's ISP internet...
Please help.

Hi,
This issue may occur if you configure the VPN connection to use the default gateway on the remote network. This setting overrides the default gateway settings that you specify in your Transmission Control Protocol/Internet Protocol (TCP/IP) settings.
Please refer to this fix:
https://support.microsoft.com/kb/317025?wa=wsignin1.0
Karen Hu
TechNet Community Support

Setting WAN port MTU?

I mentioned in another thread that I had been having some problems with NAT on the AEBS. I think I narrowed it down to something going on between my DSL router and the AEBS.
I believe the DSL router needs to have an MTU of 1460 or fewer bytes per packet. Probably becuase it encapsulates TCP/IP before sending over its DSL ATM link.
I was able to get similar broken behavior when I replaced the AEBS with a similarly configured Linksys WRT54GS and forced the MTU to 1500 in the WRT's web managment tool.
It looks like MTU set to "auto" or 1460 or fewer bytes per packet makes the WRT54GS behave nicely with the DSL modem. Presumably, that would make the AEBS happy too... if I could find a place to set the WAN port's MTU. Anybody know how to do it?
The DSL router is about a five year old Siemens Speedsteam connected by ATM to the telco's DSLAM. Perhaps newer DSL routers do something a little smarter with packet encapsulation, fragmentation and reassembly. Not mine, by the looks of it.
Thanks,
Bill

I just waned to add, the Speedstream is taking care of the PPPOE itself. The model I have is the 5861, which is a full-blown IP router. I am getting a /27 block of IPs routed to me by my ISP.
If not the MTU size, perhaps the AEBS is setting the DF bit (Don't Fragment) bit in the IP header, so if the Speedstream needs to fragment a big packet because it is slapping on additional encapsulation for PPPOE, it has to drop the packet from the AEBS because the packet is over 1500 bytes when encapsulated.
The issue is only a problem when certain ports (say, 473 for instance) are NATted. Port 80 seems to be no problem. Unfortunately, there is more than basic HTML in this world.
Bill

MPLS quastion

hi all,
1-      I have 2 sites and each site have router 3900 series
2-      The customer want to connect this sites through ISP by MPLS technology
3-      The ISP will configure this MPLS
4-      My role is enabling the Cisco routers to be adapted with MPLS configuration
5-      I received licenses to enable MPLS features on Cisco Routers and I installed it on the tow routers
6-      But kindly I want the other required configuration on the routers step by step with the commands .
7-      And if you have documents which may help me kindly send it for my mail .
Regards ,
Ahmad

it is CE Router
So you're saying all I have to configure on my routers' interfaces in the IP address (provided by my ISP), and the encapsulation type?
If that's all it is, I feel really silly.
I have thought about switching my routing protocol from RIPv2 to EIGRP or OSPF... would one of these be more 'suitable' for an MPLS mesh? I'm concerned about the amt of traffic that will be flowing through these lines, I'd like to streamline it as much as possible.
And I'm not looking forward to re-writing all of my ACL's .
if you can kindly try to send for me the best routing protocol and encapsulation type with the commands .
thanks for the info, it is big help!
note : i'm still in CCNA level so dont be angry from my quastions .

WRVS4400N vs SR520 vs UC500

Hello,
I am looking to advise a customer on networking 4 offices together. I have used the WRVS4400N for site to site VPNs before, and am quite impressed with the feature set on this router.... so much so, that I can't really find a reason to recommend the SR520 instead. I believe the customer has the money, and would be open to a superior option if we can make a good case for it, so my question is; what can the SR520 do that the WRVS4400N can not? Forget the next day replacement stuff; we could buy a standby WRVS4400N for the difference of upgrading just one to a SR520, so I don't see the value in that.
I was also curious about the routing capabilities of the UC500. Telephony features aside, how does the UC500 series function as a router? I see that the smart designs call for a SR520 to sit between the UC500 and the WAN. I can also understand that if you have a very busy network, that you may want to offload the security and routing functions to a dedicated device from a performance perspective. But lets say we have a small office that is not putting high demands on the network like this, will the UC500 function fine as a VPN endpoint, IPS, Router, and all of the other functions of an SR520, or is the UC500 missing something?
Would also like some figures on maximum throughput on each of these models if possible.
Thanks all!

The SR520 is part of the SBCS managed by CCA (Smart Business Communications System / Cisco Configuration Assistant).
The UC500 itself has a WAN interface and Firewall and a built in VPN server so if you wanted a voice solution that is customer premis based, the SBCS suite is the Unified Communications solution for you. The SR520 has FE, ADSL or T1 interface, so it can be placed in front of the UC500 if you wanted to terminate a T1 for example at the host site, but when deploying SIP Trunks for VoIP, the Service Provider usually provides the demarcation router.
The SR520 (FE and ADSL) can also find themselves as teleworker Routers for the UC500, again configurable using the same CCA tool you use on the whole SBCS suite.
If you are considering a hosted managed centrex, then the WRV4400N can work as the customer router, but there again, you may want to consult with the managed SP to see what they provide and what you provide. The WRVS4400N is not supported in the SBCS suite and you cannot buy SB Pro or Smartnet service on it either.
Steve
SE / Sales

Transparent mode with AIP-SSM-20

I currently have an ASA5510 in routed mode with an AIP-SSM-20.
There is a requirement to use a fibre optic connection between this ASA and another ASA across campus, so the AIP-SSM will have to be removed and replaced with the SSM-4GE. This part should present no issue.
However, this will remove the IPS device, and I still want to use IPS.
So, what I am thinking is to get another ASA5510, install the AIP-SSM, configure ASA for transparent mode and put it in between the inside of the routed ASA and my LAN. The transparent ASA would be functioning strictly as an IPS appliance.
Setup would look something like this:
Internal LAN <> transparent ASA with IPS <> routed ASA <> WAN
Can the AIP-SSM still perform IPS with the ASA in transparent mode?
Is there a way to configure the ASA and AIP-SSM such that traffic to/from a particular server completely bypasses the AIP-SSM?
I have a couple of fileservers that generate heavy traffic and could overload the AIP-SSM.
Regards.

AFAIR, There is no problem to setup AIP in a transparent firewall.
"An ASA in transparent mode can run an AIP. In the event the AIP fails,
the IPS will fail-open and the ASA will continue to pass traffic.
However, if an interface or cable fails, then traffic will stop. You
would need a failover pair to account for this failure event, which
means another ASA and matching AIP."
And no there is no problem to exclude certain hosts/ports/subnets from inspection by IPS via MPF.
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ips.html#wp1050744
What I however consider however is if the ASAs 5510 as second tier firewall for 5520s will be enough.
http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html
HTH,
Marcin

Cisco IOS IPS in Cisco 2921/k9 router

Hi All,
I have a router of Cisco 2921 series (C2921/K9) basic box with IP BAse IOS image (SL-29-IPB-K9 IOS). I would like to enable IOS Level IPS feature on this Router now. Based on the Cisco Document i have found i need to purchase an additonal subscripton license to enale the IPS feature. My querry is-
Will it support on the Basic IP Base IOS or do i need to change the IOS?
If i need to purchase the Subscription Licesne, how can i get the part number and cost for the same?
Do i need to buy any addtional module for this like (NME-IPS-K9) ?
Thanks in advance for your quick support
regards
Sunny

Hi Sunny
1. Yes you can enable IPS on IOS with the security license, without buying a subscription, but this would make little sense - new signatures are being released all the time so you would not be protected from recently discovered vulnerabilities/attacks.
2. Correct, the modules and appliances run a different kind of software and are much more powerful
3. If you add the module, you do NOT need the security license. It would still be advised to get a subscription license to get signature updates for the module.
I hope this helps, let us know.
regards
Herbert
jacob.samuel wrote:Dear Herbert,Thanks alot for the wonderful post. It clear most of my doubts. Still i kindly need to know few more points-1) Cant we enable IPS Feature on 2921/K9 router (with Sec license or 2921Sec/K9 bundle) without signature subscription license (is it a must? it is for getting updates of signatures and for support only, right?)2) I came to know from a distributor pre-sales engineer that the Cisco IOS Level Intrusion Protection is not going to provide the full feature of IPS like NME module or IPS Applinace. Is that right?3) If i add NME-IPS-K9 Module to my 2921 Router, without enabling Sec License, can i enable IPS feature on the Router. Or is it a must that i need to buy Sec License (SL-29-SEC-K9)?Attaching the Datasheet of NME-IPS-K9 module (Page num 5 above Table 3) mentione as follows-Cisco IOS Software Feature Sets and ReleaseTable 3 lists the required Cisco IOS feature sets and releases for Cisco IPS AIM and IPS NME on the Cisco 1841,
2800 and 3800 series Integrated Services Routers Note that, IPS NME on the Cisco 2900 and 3900 Integrated
Services Routers does not require a Security Feature license.
In that case if i buy a module i can install it on the 2921K9 box directly and can enable the IPS feature right? I dont need any License and additonal signature subscription here to enable the IPS feature (if i dont need signature updates and support) right?
thanks alot for the support.
regards
Sunny

Routing issue- seeing same IPs for two hops

Hello All,
I'm seeing two same IPs in the traceroute output. Is that due to routing issue that nexhop is as the same device for the first time?
Log:
6 10.30.102.26 61.060 ms 10.30.100.142 61.266 ms 10.30.102.26 61.071 ms
7 10.30.102.26 61.139 ms 61.211 ms 10.61.191.2 60.948 ms
Can you guys help me to fix the issue??
Regards,
Thiyagu

Are you load balancing anywhere?
6 10.30.102.26 61.060 ms
   10.30.100.142 61.266 ms
   10.30.102.26 61.071 ms
7 10.30.102.26 61.139 ms 61.211 ms
   10.61.191.2 60.948 ms
HTH,
John
*** Please rate all useful posts ***

Correct procedure to update IOS IPS signatures on 2911 router

What is the correct procedure to update the IOS IPS signatures on an 2911 router?
I know how to download the signatures file (eg. IOS-S556-CLI.pkg) but what is the correct way to install the update?
Thank you in advance!

The IPS signature package comes with a list of pre-enabled signatures, hence Cisco does not recommend enabling a lot more other signatures, especially not every single signature as documented.
The reason why is because the package might include retired/old signatures only for references, and not every single signature is required to protect your environment because you might not have the traffic for some signatures, you might not have some end hosts that are written with specific signatures, therefore, it becomes irrelevant if you enable it.
Typically here is how customer would enable/disable signatures:
- Use the default signature that is enabled by Cisco (the default should fit majority of the customers).
- Monitor it for a couple of months
- Disable those that you don't need, and enable others if you think you require it for specific.

Mac OS X Server 1-to-1 Routing: Multiple DSL Static IPs

Hi all -
Question here regarding Mac OS X Server 10.4's ability to handle multiple static IP's coming from my DSL ISP. Can this be handled through the Server Admin GUI or does it need to be done in Terminal with iptables or something similar?
My ultimate goal is to send 1 of the static IPs to a Mac Pro, another to a Mini, another to a DVR, etc.
As a piggyback question - what is the general consensus here on using a Mac Pro or Xserve with Gateway Setup Assistant as a VPN router in place of a traditional SonicWALL / Linksys / Netgear, etc?
Thanks in advance.
Eric

>As a piggyback question - what is the general consensus here on using a Mac Pro or Xserve with Gateway Setup Assistant as a VPN router in place of a traditional SonicWALL / Linksys / Netgear, etc?
Go with the traditional box.
For a few bucks you get a box that's designed for that kind of thing, has a far better interface for managing it, and far more fine-grained control over what traffic can come through.
In addition to that, by having a dedicated hardware router/firewall/NAT device you avoid the chance to leak any services to the public - if you're like most people, your gateway machine isn't just running as a gateway - it's also got sshd running, maybe a web server, file server, DNS server, possible even running as a directory server.
Since this gateway machine, by definition, has its proverbial *** hanging out in the wind there's a possibility that these services could be compromised by remote hackers.
By using a dedicated hardware box you can be very specific about what incoming traffic you want to allow, completely insulating your server from the outside world except for the services you know you really want to be public.

Connecting to NME-IPS results in connecting to cisco router itself

Suddenly, without any clear reason, I cannot access the NME-IPS in my router.
Instead it connects to the router console.
The IP address is also pingable.
Output:
gateway#service-module IDS-Sensor 1/0 status
Service Module is Cisco IDS-Sensor1/0
Service Module supports session via TTY line 66
Service Module is in Steady state
Service Module heartbeat-reset is enabled
Getting status from the Service Module, please wait..
Cisco Systems Intrusion Prevention System Network Module
Software version: 7.0(6)E4
Model:             NME-IPS
Memory:            443504 KB
Mgmt IP addr:      192.168.11.99
Mgmt web ports:    443
Mgmt TLS enabled: true
gateway#service-module IDS-Sensor 1/0 session
Trying 192.168.11.99, 2066 ... Open
C
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege level of 15.
Please change these publicly known initial credentials using SDM or the IOS CLI.
Here are the Cisco IOS commands.
username <myuser> privilege 15 secret 0 <mypassword>
no username cisco
Replace <myuser> and <mypassword> with the username and password you want to use.
For more information about SDM please follow the instructions in the QUICK START
GUIDE for your router or go to http://www.cisco.com/go/sdm
User Access Verification
Username:

If IME is not connecting, is it giving you some sort of error?
Do you have ASDM launcher loaded? if so, does it also fail to connect?
When you launch IME are you prompted for a password, is that failing on the password entry or does it simply fail to connect to the device?
I have not been able to access my NME via https either, I get a Java error, but I pretty much always use Cisco IME to access my NME module so I have not chased down the Java issue.

IOS IPS/IDS on a BGP Peering Router?

We have a pair of BP peerings between our network and our upstream service provider. Since the peering points are geographically distributed and we run a "cold potato" routing policy on our network we cannot guarantee symmetric routing for traffic exchanged with our upstream service provider.
Yesterday we followed the bouncing ball through the IPS/IDS setup documentation on a Cisco 2901 running 15.2(4)M3 and acting as a BGP speaking peering router at one of our peering points. Immediately the router started throwing %IPS-6-SEND_TCP_PAK and %IPS-6-TIMEOUT_EVENT messages in the logs. We also observed that some upstream service provider web sites became inaccessible to our users. Turning off IPS/IDS on the 2901 restored connectivity for our users to those web sites.
Three questions:
Do the default Cisco IOS IPS/IDS rules assume that the router will see both sides of each TCP session?
Does the Cisco IOS IPS/IDS TCP stream reassembly assume an attack and send TCP RST frames when it doesn't see both sides of a TCP session?
Should we move the Cisco IPS/IDS functionality from the BGP-speaking routers at peering points to our customer sites, as the customer sites are the only places in our network guaranteed to see both sides of a given TCP session? (We already perform NAT on the customer site routers for that reason.)

Hello Bill,
1) Yes, there are some normalizer functions on some IOS-IPS signatures that will behave like that with this scenarios (Asymetric routing not something good to any kind of security device)
2) Yes, it will close the connections, I will definetly need to look for specific actions regarding that but you could just check the IOS IPS Signature statistics on your router , see which is the one triggering the most and then see the action configured for it (and change it if required)
3) If you cannot change that behavior then it would be safe to tell the router is not a good place to set an IPS or any other kind of firewall configuration unless you set with a weaker security policy (useless from a security standard point of view)
Check my blog at http:laguiadelnetworking.com for further information.
Cheers,
Julio Carvajal Segura

Router NME IPS - use promiscuous and inline mode simultaneous

Hi all,
we are using the IPS module NME-IPS-K9 on a Cisco 2951 router. We like to use the IPS in promiscuous and inline mode simultaneous. For example traffic from a client to a server should pass through the IPS. But the IPS should only recieve a copy of the VoIP traffic.
In the interface configuration mode the following command is set.
     ids-service-module monitoring promiscuous access-list 101
If I try to set a interface to inline mode I get the following message:
     "Only either Inline or Promiscuous
     monitoring is supported on the router at one time.
     Please remove Promiscuous monitoring on all interfaces
     before configuring Inline monitoring. Only either Inline or Promiscuous
     monitoring is supported on the router at one time.
     Please remove Promiscuous monitoring on all interfaces
     before configuring Inline monitoring."
Is there any way to use promiscuous and inline monitoring at the same time? Is there a firmware update available which includes this feature? Any other idears?
IOS version of the router: 15.0(1)M4
IPS version: 7.0(2)E4
Kind Regards

In promiscuous mode your sensor doesn't affect the traffic but it only listen and analyze it.
In inline mode you direct all your traffic on this network segment you want to protect to IPS and it analyze it and block some actions according to your settings.
It is the main difference. Which mode to prefer must be your decision.

IPS router 3900

Similar Messages

Maybe you are looking for