SlideShare a Scribd company logo

CCNA Security - Chapter 5

Irsandi Hasan, profile picture
Irsandi Hasan

This document provides an overview of implementing intrusion prevention systems. It describes the purpose and operations of network-based and host-based IPS, how IPS signatures are used to detect malicious traffic, and how to configure and monitor Cisco IOS IPS using the command line interface and Security Device Manager. The objectives are to describe IPS functions, signatures, alarms, actions, and monitoring, as well as configure and verify Cisco IOS IPS.

1 of 79
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
CCNA Security Chapter Five Implementing Intrusion Prevention © 2009 Cisco Learning Institute. 1
Lesson Planning • This lesson should take 3-6 hours to present • The lesson should include lecture, demonstrations, discussion and assessments • The lesson can be taught in person or using remote instruction © 2009 Cisco Learning Institute. 2
Major Concepts • Describe the purpose and operation of network- based and host-based Intrusion Prevention Systems (IPS) • Describe how IDS and IPS signatures are used to detect malicious network traffic • Implement Cisco IOS IPS operations using CLI and SDM • Verify and monitor the Cisco IOS IPS operations using CLI and SDM © 2009 Cisco Learning Institute. 3
Lesson Objectives Upon completion of this lesson, the successful participant will be able to: 1. Describe the functions and operations of IDS and IPS systems 2. Introduce the two methods of implementing IPS and describe host based IPS 3. Describe network-based intrusion prevention 4. Describe the characteristics of IPS signatures 5. Describe the role of signature alarms (triggers) in Cisco IPS solutions 6. Describe the role of tuning signature alarms (triggers) in a Cisco IPS solution © 2009 Cisco Learning Institute. 4
Lesson Objectives 7. Describe the role of signature actions in a Cisco IPS solution 8. Describe the role of signature monitoring in a Cisco IPS solution 9. Describe how to configure Cisco IOS IPS Using CLI 10. Describe how to configure Cisco IOS IPS using Cisco SDM 11. Describe how to modify IPS signatures in CLI and SDM 12. Describe how to verify the Cisco IOS IPS configuration 13. Describe how to monitor the Cisco IOS IPS events 14. Describe how to troubleshoot the Cisco IOS IPS events © 2009 Cisco Learning Institute. 5
Common Intrusions MARS ACS VPN Zero-day exploit Remote Worker attacking the network Firewall VPN VPN Iron Port Remote Branch LAN CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 6
Intrusion Detection Systems (IDSs) 1. An attack is launched on a network that has a sensor deployed in promiscuous IDS mode; therefore copies of all packets are sent to the IDS sensor for packet analysis. However, the target machine will Switch experience the malicious attack. 1 2. The IDS sensor, matches the malicious traffic to a signature and sends the switch a command to 2 deny access to the source of the malicious traffic. Sensor 3. The IDS can also send an alarm to a management console for logging 3 and other management purposes. Management Target Console © 2009 Cisco Learning Institute. 7
Intrusion Prevention Systems (IPSs) 1 1. An attack is launched on a network that has a sensor deployed in IPS mode (inline mode). 2. The IPS sensor analyzes the packets as they enter the IPS sensor interface. The IPS sensor matches the malicious traffic to a 2 signature and the attack is stopped Sensor 4 immediately. 3. The IPS sensor can also send an alarm to a management console for logging and other management Bit Bucket purposes. 4. Traffic in violation of policy can be 3 dropped by an IPS sensor. Target Management Console © 2009 Cisco Learning Institute. 8
Common characteristics of IDS and IPS  Both technologies are deployed using sensors.  Both technologies use signatures to detect patterns of misuse in network traffic.  Both can detect atomic patterns (single- packet) or composite patterns (multi- packet). © 2009 Cisco Learning Institute. 9
Comparing IDS and IPS Solutions Advantages Disadvantages  Response action cannot  No impact on network stop trigger packets Promiscuous Mode (latency, jitter)  Correct tuning required for  No network impact if there is a response actions IDS sensor failure  Must have a well thought-  No network impact if there is out security policy sensor overload  More vulnerable to network evasion techniques © 2009 Cisco Learning Institute. 10
Comparing IDS and IPS Solutions Advantages Disadvantages  Sensor issues might affect network traffic Inline Mode  Sensor overloading  Stops trigger packets impacts the network IPS  Can use stream normalization  Must have a well thought- techniques out security policy  Some impact on network (latency, jitter) © 2009 Cisco Learning Institute. 11
Network-Based Implementation CSA MARS VPN Remote Worker Firewall VPN IPS CSA VPN Iron Port Remote Branch CSA CSA CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 12
Host-Based Implementation CSA CSA MARS VPN Management Center for Remote Worker Cisco Security Agents Firewall VPN IPS CSA VPN Agent Iron Port Remote Branch CSA CSA CSA CSA CSA CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 13
Cisco Security Agent Corporate Network Application Server Agent Agent Firewall Untrusted Network Agent Agent Agent Agent SMTP Agent Agent Agent Server Web DNS Server Server Management Center for Cisco Security Agents video © 2009 Cisco Learning Institute. 14
Cisco Security Agent Screens A warning message appears when CSA detects a Problem. CSA maintains a log file allowing the user to verify problems and A waving flag in the learn more information. system tray indicates a potential security problem. © 2009 Cisco Learning Institute. 15
Host-Based Solutions Advantages and Disadvantages of HIPS Advantages Disadvantages  The  HIPS does not provide a success or complete network picture. failure of an attack can  HIPS has a requirement to be readily support multiple operating determined. systems.  HIPS does not have to worry about fragmentati on attacks or variable Time to Live (TTL) attacks. © 2009 Cisco Learning Institute. 16
Network-Based Solutions Corporate Network Sensor Firewall Router Untrusted Network Sensor Management Server Sensor Web DNS Server Server © 2009 Cisco Learning Institute. 17
Cisco IPS Solutions AIM and Network Module Enhanced • Integrates IPS into the Cisco 1841 (IPS AIM only), 2800 and 3800 ISR routers • IPS AIM occupies an internal AIM slot on router and has its own CPU and DRAM • Monitors up to 45 Mb/s of traffic • Provides full-featured intrusion protection • Is able to monitor traffic from all router interfaces • Can inspect GRE and IPsec traffic that has been decrypted at the router • Delivers comprehensive intrusion protection at branch offices, isolating threats from the corporate network • Runs the same software image as Cisco IPS Sensor Appliances © 2009 Cisco Learning Institute. 18
Cisco IPS Solutions ASA AIP-SSM • High-performance module designed to provide additional security services to the Cisco ASA 5500 Series Adaptive Security Appliance • Diskless design for improved reliability • External 10/100/1000 Ethernet interface for management and software downloads • Intrusion prevention capability • Runs the same software image as the Cisco IPS Sensor appliances © 2009 Cisco Learning Institute. 19
Cisco IPS Solutions 4200 Series Sensors • Appliance solution focused on protecting network devices, services, and applications • Sophisticated attack detection is provided. © 2009 Cisco Learning Institute. 20
Cisco IPS Solutions Cisco Catalyst 6500 Series IDSM-2 • Switch-integrated intrusion protection module delivering a high-value security service in the core network fabric device • Support for an unlimited number of VLANs • Intrusion prevention capability • Runs the same software image as the Cisco IPS Sensor Appliances © 2009 Cisco Learning Institute. 21
IPS Sensors • Factors that impact IPS sensor selection and deployment: - Amount of network traffic - Network topology - Security budget - Available security staff • Size of implementation - Small (branch offices) - Large - Enterprise © 2009 Cisco Learning Institute. 22
Comparing HIPS and Network IPS Advantages Disadvantages  Is host-specific  Operating system dependent  Protects host after decryption HIPS  Lower level network events  Provides application-level not seen encryption protection  Host is visible to attackers  Is cost-effective  Cannot examine encrypted traffic  Not visible on the network  Does not know whether an Network Operating system  attack was successful IPS independent  Lower level network events seen © 2009 Cisco Learning Institute. 23
Signature Characteristics • An IDS or IPS sensor Hey, come look at this. This matches a signature with looks like the signature of a a data flow LAND attack. • The sensor takes action • Signatures have three distinctive attributes - Signature type - Signature trigger - Signature action © 2009 Cisco Learning Institute. 24
Signature Types • Atomic - Simplest form - Consists of a single packet, activity, or event - Does not require intrusion system to maintain state information - Easy to identify • Composite - Also called a stateful signature - Identifies a sequence of operations distributed across multiple hosts - Signature must maintain a state known as the event horizon © 2009 Cisco Learning Institute. 25
Signature File © 2009 Cisco Learning Institute. 26
Signature Micro-Engines Version 4.x Version 5.x Description SME Prior 12.4(11)T Atomic – Examine simple packets SME 12.4(11)T and later ATOMIC.IP ATOMIC.IP Provides simple Layer 3 IP alarms Provides simple Internet Control Message Protocol (ICMP) alarms based on the following parameters: type, code, ATOMIC.ICMP ATOMIC.IP sequence, and ID ATOMIC.IPOPTIONS ATOMIC.IP Provides simple alarms based on the decoding of Layer 3 options Provides simple User Datagram Protocol (UDP) packet alarms based on the following parameters: port, direction, and ATOMIC.UDP ATOMIC.IP data length ATOMIC.TCP Service – Examine the many services that are attacked ATOMIC.IP Provides simple TCP packet alarms based on the following parameters: port, destination, and flags SERVICE.DNS SERVICE.DNS Analyzes the Domain Name System (DNS) service SERVICE.RPC SERVICE.RPC Analyzes the remote-procedure call (RPC) service SERVICE.SMTP STATE Inspects Simple Mail Transfer Protocol (SMTP) SERVICE.HTTP SERVICE.HTTP Provides HTTP protocol decode-based string engine that includes ant evasive URL de-obfuscation SERVICE.FTP String – Use expression-based patterns to detect intrusions SERVICE.FTP Provides FTP service special decode alarms STRING.TCP STRING.TCP Offers TCP regular expression-based pattern inspection engine services STRING.UDP STRING.UDP Offers UDP regular expression-based pattern inspection engine services STRING.ICMP Multi-String Supports flexible pattern matching STRING.ICMP Provides ICMP regular expression-based pattern inspection engine services MULTI-STRING MULTI-STRING Supports flexible pattern matching and supports Trend Labs signatures OTHER NORMALIZER Provides internal engine to handle miscellaneous signatures Other – Handles miscellaneous signatures © 2009 Cisco Learning Institute. 27
Cisco Signature List © 2009 Cisco Learning Institute. 28
Signature Triggers Advantages Disadvantages • Easy configuration • No detection of unknown signatures Pattern-based • Fewer false positives • Initially a lot of false positives Detection • Good signature design • Signatures must be created, updated, and tuned • Simple and reliable • Generic output Anomaly- based • Customized policies • Policy must be created Detection • Can detect unknown attacks • Easy configuration • Difficult to profile typical activity in large Policy-based networks • Can detect unknown attacks Detection • Traffic profile must be constant • Window to view attacks • Dedicated honey pot server Honey Pot- • Distract and confuse attackers • Honey pot server must not be trusted Based • Slow down and avert attacks Detection • Collect information about attack © 2009 Cisco Learning Institute. 29
Pattern-based Detection Signature Type Trigger Atomic Signature Stateful Signature No state required to Must maintain state or examine Pattern- examine pattern to multiple items to determine if based determine if signature signature action should be detection action should be applied applied Detecting for an Address Searching for the string Resolution Protocol confidential across multiple Example (ARP) request that has a packets in a TCP session source Ethernet address of FF:FF:FF:FF:FF:FF © 2009 Cisco Learning Institute. 30
Anomaly-based Detection Signature Type Trigger Atomic Signature Stateful Signature No state required to Anomaly- State required to identify identify activity that based activity that deviates from deviates from normal detection normal profile profile Detecting traffic that is going to a destination port Verifying protocol compliance Example that is not in the normal for HTTP traffic profile © 2009 Cisco Learning Institute. 31
Policy-based Detection Signature Type Signature Trigger Atomic Signature Stateful Signature Policy- No state required to Previous activity (state) based identify undesirable required to identify undesirable detection behavior behavior Detecting abnormally A SUN Unix host sending RPC large fragmented packets requests to remote hosts Example by examining only the last without initially consulting the fragment SUN PortMapper program. © 2009 Cisco Learning Institute. 32
Honey Pot-based Detection • Uses a dummy server to attract attacks • Distracts attacks away from real network devices • Provides a means to analyze incoming types of attacks and malicious traffic patterns • Is useful for finding common attacks on network resources and implementing patches/fixes for real network purposes © 2009 Cisco Learning Institute. 33
Cisco IOS IPS Solution Benefits • Uses the underlying routing infrastructure to provide an additional layer of security with investment protection • Attacks can be effectively mitigated to deny malicious traffic from both inside and outside the network • Provides threat protection at all entry points to the network when combined with other Cisco solutions • Is supported by easy and effective management tools • Offers pervasive intrusion prevention solutions that are designed to integrate smoothly into the network infrastructure and to proactively protect vital resources • Supports approximately 2000 attack signatures from the same signature database that is available for Cisco IPS appliances © 2009 Cisco Learning Institute. 34
Signature Alarms Alarm Type Network Activity IPS Activity Outcome Alarm False positive Normal user traffic Tune alarm generated No alarm False negative Attack traffic Tune alarm generated Alarm Ideal True positive Attack traffic generated setting No alarm Ideal True negative Normal user traffic generated setting © 2009 Cisco Learning Institute. 35
Signature Tuning Levels Informational – Activity that triggers the signature High –an-immediate threat, but the information DoS Medium Abnormal networkaccess detected, a could is not– Abnormal network activity is or cause Low Attacks used to gain activity is detected, attack are detected (immediate threat likely be malicious, and immediate threat is extremely likely could provided is useful be malicious, and immediate threat is not likely © 2009 Cisco Learning Institute. 36
Generating an Alert Specific Alert Description This action writes the event to the Event Store as Produce alert an alert. Produce verbose This action includes an encoded dump of the alert offending packet in the alert. © 2009 Cisco Learning Institute. 37
Logging the Activity Specific Alert Description This action starts IP logging on packets that Log attacker contain the attacker address and sends an packets alert. This action starts IP logging on packets that Log pair packets contain the attacker and victim address pair. Log victim This action starts IP logging on packets that packets contain the victim address and sends an alert. © 2009 Cisco Learning Institute. 38
Dropping/Preventing the Activity Specific Alert Description • Terminates the current packet and future packets from this attacker address for a period of time. • The sensor maintains a list of the attackers currently being denied by the system. Deny attacker • Entries may be removed from the list manually or inline wait for the timer to expire. • The timer is a sliding timer for each entry. • If the denied attacker list is at capacity and cannot add a new entry, the packet is still denied. Deny connection •Terminates the current packet and future packets inline on this TCP flow. Deny packet •Terminates the packet. inline © 2009 Cisco Learning Institute. 39
Resetting a TCP Connection/Blocking Activity/Allowing Activity Specific Category Description Alert Resetting a Reset TCP • Sends TCP resets to hijack and terminate the TCP connection TCP flow connection Request • This action sends a request to a blocking block device to block this connection. connection Blocking Request • This action sends a request to a blocking future block host device to block this attacker host. activity • Sends a request to the notification application Request component of the sensor to perform SNMP SNMP trap notification. Allowing • Allows administrator to define exceptions to Activity configured signatures © 2009 Cisco Learning Institute. 40
Planning a Monitoring Strategy The MARS appliance detected and mitigated the ARP poisoning attack. There are four factors to There are four factors to consider when planning a consider when planning a monitoring strategy. monitoring strategy. ••Management method Management method ••Event correlation Event correlation ••Security staff Security staff ••Incident response plan Incident response plan © 2009 Cisco Learning Institute. 41
MARS The security operator examines The security operator examines the output generated by the the output generated by the MARS appliance: MARS appliance: ••MARS is used to centrally MARS is used to centrally manage all IPS sensors. manage all IPS sensors. ••MARS is used to correlate all MARS is used to correlate all of the IPS and Syslog events of the IPS and Syslog events in a central location. in a central location. ••The security operator must The security operator must proceed according to the proceed according to the incident response plan incident response plan identified in the Network identified in the Network Security Policy. Security Policy. © 2009 Cisco Learning Institute. 42
Cisco IPS Solutions • Locally Managed Solutions: - Cisco Router and Security Device Manager (SDM) - Cisco IPS Device Manager (IDM) • Centrally Managed Solutions: - Cisco IDS Event Viewer (IEV) - Cisco Security Manager (CSM) - Cisco Security Monitoring, Analysis, and Response System (MARS) © 2009 Cisco Learning Institute. 43
Cisco Router and Security Device Manager Monitors and prevents intrusions by comparing traffic against signatures of known threats and blocking the traffic when a threat is detected Lets administrators control the application of Cisco IOS IPS on interfaces, import and edit signature definition files (SDF) from Cisco.com, and configure the action that Cisco IOS IPS is to take if a threat is detected © 2009 Cisco Learning Institute. 44
Cisco IPS Device Manager • A web-based configuration tool • Shipped at no additional cost with the Cisco IPS Sensor Software • Enables an administrator to configure and manage a sensor • The web server resides on the sensor and can be accessed through a web browser © 2009 Cisco Learning Institute. 45
Cisco IPS Event Viewer • View and manage alarms for up to five sensors • Connect to and view alarms in real time or in imported log files • Configure filters and views to help you manage the alarms. • Import and export event data for further analysis. © 2009 Cisco Learning Institute. 46
Cisco Security Manager • Powerful, easy-to-use solution to centrally provision all aspects of device configurations and security policies for Cisco firewalls, VPNs, and IPS • Support for IPS sensors and Cisco IOS IPS • Automatic policy-based IPS sensor software and signature updates • Signature update wizard © 2009 Cisco Learning Institute. 47
Cisco Security Monitoring Analytic and Response System • An appliance-based, all- inclusive solution that allows network and security administrators to monitor, identify, isolate, and counter security threats • Enables organizations to more effectively use their network and security resources. • Works in conjunction with Cisco CSM. © 2009 Cisco Learning Institute. 48
Secure Device Event Exchange Network Alarm Management SDEE Protocol Console Alarm Syslog Syslog Server • The SDEE format was developed to improve communication of events generated by security devices • Allows additional event types to be included as they are defined © 2009 Cisco Learning Institute. 49
Best Practices • The need to upgrade sensors with the latest signature packs must be balanced against the momentary downtime. • When setting up a large deployment of sensors, automatically update signature packs rather than manually upgrading every sensor. • When new signature packs are available, download the new signature packs to a secure server within the management network. Use another IPS to protect this server from attack by an outside party. • Place the signature packs on a dedicated FTP server within the management network. If a signature update is not available, a custom signature can be created to detect and mitigate a specific attack. © 2009 Cisco Learning Institute. 50
Best Practices • Configure the FTP server to allow read-only access to the files within the directory on which the signature packs are placed only from the account that the sensors will use. • Configure the sensors to automatically update the signatures by checking the FTP server for the new signature packs periodically. Stagger the time of day when the sensors check the FTP server for new signature packs. • The signature levels that are supported on the management console must remain synchronized with the signature packs on the sensors themselves. © 2009 Cisco Learning Institute. 51
Overview of Implementing IOS IPS I want to use CLI to manage my signature 1. Download the IOS IPS files for IPS. I have files downloaded the IOS IPS files. 2. Create an IOS IPS configuration directory on Flash 3. Configure an IOS IPS crytpo key 4. Enable IOS IPS 5. Load the IOS IPS Signature Package to the router © 2009 Cisco Learning Institute. 52
1. Download the Signature File Download IOS IPS signature package files and public crypto key © 2009 Cisco Learning Institute. 53
2. Create Directory R1# mkdir ips Create directory filename [ips]? Created dir flash:ips R1# R1# dir flash: Directory of flash:/ 5 -rw- 51054864 Jan 10 2009 15:46:14 -08:00 c2800nm-advipservicesk9-mz.124-20.T1.bin 6 drw- 0 Jan 15 2009 11:36:36 -08:00 ips 64016384 bytes total (12693504 bytes free) R1# To rename a directory: R1# rename ips ips_new Destination filename [ips_new]? R1# © 2009 Cisco Learning Institute. 54
3. Configure the Crypto Key 1 2 R1# conf t R1(config)# 1 – Highlight and copy the text contained in the public key file. 2 – Paste it in global configuration mode. © 2009 Cisco Learning Institute. 55
Confirm the Crypto Key R1# show run <Output omitted> crypto key pubkey-chain rsa named-key realm-cisco.pub signature key-string 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101 00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16 17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128 B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E 5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35 FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85 50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36 006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE 2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3 F3020301 0001 <Output omitted> © 2009 Cisco Learning Institute. 56
4. Enable IOS IPS R1(config)# ip ips name iosips 1 R1(config)# ip ips name ips list ? 1 – IPS rule is created <1-199> Numbered access list WORD Named access list 2 R1(config)# 2 – IPS location in flash identified R1(config)# ip ips config location flash:ips R1(config)# R1(config)# ip http server R1(config)# ip ips notify sdee 3 R1(config)# ip ips notify log R1(config)# 3 – SDEE and Syslog notification are enabled © 2009 Cisco Learning Institute. 57
4. Enable IOS IPS R1(config)# ip ips signature-category R1(config-ips-category)# category all 1 – The IPS all category is retired 1 R1(config-ips-category-action)# retired true R1(config-ips-category-action)# exit R1(config-ips-category)# 2 – The IPS basic category is unretired. R1(config-ips-category)# category ios_ips basic 2 R1(config-ips-category-action)# retired false R1(config-ips-category-action)# exit R1(config-ips-category)# exit Do you want to accept these changes? [confirm] y R1(config)# R1(config)# interface GigabitEthernet 0/1 R1(config-if)# ip ips iosips in 3 R1(config-if)# exit 3 – The IPS rule is applied in a incoming direction R1(config)#exit R1(config)# interface GigabitEthernet 0/1 4 R1(config-if)# ip ips iosips in R1(config-if)# ip ips iosips out R1(config-if)# exit R1(config)# exit 4 – The IPS rule is applied in an incoming and outgoing direction. © 2009 Cisco Learning Institute. 58
5. Load Signature Package 1 – Copy the signatures from the FTP server. 1 R1# copy ftp://cisco:cisco@10.1.1.1/IOS-S376-CLI.pkg idconf Loading IOS-S310-CLI.pkg !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 7608873/4096 bytes] *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDS_STARTED: 16:44:47 PST Jan 15 2008 2 *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDING: multi-string - 8 signatures - 1 of 13 engines *Jan 15 16:44:47 PST: %IPS-6-ENGINE_READY: multi-string - build time 4 ms - packets for this engine will be scanned *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDING: service-http - 622 signatures - 2 of 13 engines *Jan 15 16:44:53 PST: %IPS-6-ENGINE_READY: service-http - build time 6024 ms - packets for this engine will be scanned <Output omitted> *Jan 15 16:45:18 PST: %IPS-6-ENGINE_BUILDING: service-smb-advanced - 35 signatures - 12 of 13 engines *Jan 15 16:45:18 PST: %IPS-6-ENGINE_READY: service-smb-advanced - build time 16 ms - packets for this engine will be scanned *Jan 15 16:45:18 PST: %IPS-6-ENGINE_BUILDING: service-msrpc - 25 signatures - 13 of 13 engines *Jan 15 16:45:18 PST: %IPS-6-ENGINE_READY: service-msrpc - build time 32 ms - packets for this engine will be scanned *Jan 15 16:45:18 PST: %IPS-6-ALL_ENGINE_BUILDS_COMPLETE: elapsed time 31628 ms 2 – Signature compiling begins immediately after the signature package is loaded to the router. © 2009 Cisco Learning Institute. 59
Verify the Signature R1# show ip ips signature count Cisco SDF release version S310.0 ← signature package release version Trend SDF release version V0.0 Signature Micro-Engine: multi-string: Total Signatures 8 multi-string enabled signatures: 8 multi-string retired signatures: 8 <Output omitted> Signature Micro-Engine: service-msrpc: Total Signatures 25 service-msrpc enabled signatures: 25 service-msrpc retired signatures: 18 service-msrpc compiled signatures: 1 service-msrpc inactive signatures - invalid params: 6 Total Signatures: 2136 Total Enabled Signatures: 807 Total Retired Signatures: 1779 Total Compiled Signatures: 351 ← total compiled signatures for the IOS IPS Basic category Total Signatures with invalid parameters: 6 Total Obsoleted Signatures: 11 R1# © 2009 Cisco Learning Institute. 60
Configuring Cisco IOS IPS in SDM Create IPS – this tab contains the IPS Rule wizard Edit IPS – this tab allows the edit of rules and apply or remove them from interfaces Security Dashboard– this tab is used to view the Top Threats table and deploy signatures IPS Migration – this tab is used to migrate configurations created in earlier versions of the IOS © 2009 Cisco Learning Institute. 61
Using SDM 1. Choose Configure > Intrusion Prevention > Create IPS 2. Click the Launch IPS Rule Wizard button 3. Click Next © 2009 Cisco Learning Institute. 62
Using SDM 4. Choose the router interface by checking either the Inbound or Outbound checkbox (or both) 5. Click Next © 2009 Cisco Learning Institute. 63
Using SDM 6. Click the preferred option and fill in the appropriate text box 7. Click download for the latest signature file 8. Go to 9. Download the key to a PC www.cisco.com/pcgi-bin/tablebuild.pl/ios-v5sigup to obtain the public key 11. Copy the text between the 10. Open the key in a text editor phrase “key-string” and the and copy the text after the work “quit” into the Key field phrase “named-key” into the Name field 12. Click Next © 2009 Cisco Learning Institute. 64
Using SDM 13. Click the ellipsis (…) button and enter config location 14. Choose the category that will allow the Cisco IOS IPS to function efficiently on the router 15. Click finish © 2009 Cisco Learning Institute. 65
SDM IPS Wizard Summary © 2009 Cisco Learning Institute. 66
Generated CLI Commands R1# show run <Output omitted> ip ips name sdm_ips_rule ip ips config location flash:/ipsdir/ retries 1 ip ips notify SDEE ! ip ips signature-category category all retired true category ios_ips basic retired false ! interface Serial0/0/0 ip ips sdm_ips_rule in ip virtual-reassembly <Output omitted> © 2009 Cisco Learning Institute. 67
Using CLI Commands R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-definition R1(config-sigdef)# signature 6130 10 This example shows how R1(config-sigdef-sig)# status R1(config-sigdef-sig-status)# retired true to retire individual R1(config-sigdef-sig-status)# exit signatures. In this case, R1(config-sigdef-sig)# exit R1(config-sigdef)# exit signature 6130 with subsig Do you want to accept these changes? [confirm] y ID of 10. R1(config)# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-category R1(config-ips-category)# category ios_ips basic This example shows how R1(config-ips-category-action)# retired false R1(config-ips-category-action)# exit to unretire all signatures R1(config-ips-category)# exit that belong to the IOS IPS Do you want to accept these changes? [confirm] y R1(config)# Basic category. © 2009 Cisco Learning Institute. 68
Using CLI Commands for Changes R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-definition R1(config-sigdef)# signature 6130 10 R1(config-sigdef-sig)# engine R1(config-sigdef-sig-engine)# event-action produce-alert R1(config-sigdef-sig-engine)# event-action deny-packet-inline R1(config-sigdef-sig-engine)# event-action reset-tcp-connection R1(config-sigdef-sig-engine)# exit R1(config-sigdef-sig)# exit R1(config-sigdef)# exit This example shows how to Do you want to accept these changes? [confirm] y R1(config)# change signature actions to alert, drop, and reset for signature 6130 with subsig ID of 10. © 2009 Cisco Learning Institute. 69
Viewing Configured Signatures Choose Configure > Intrusion Prevention > Edit IPS > Signatures > All Categories Filter the signature list according to type To modify a signature, right- click on the signature then choose an option from the pop-up © 2009 Cisco Learning Institute. 70
Modifying Signature Actions To tune a signature, choose Configure > Intrusion Prevention > Edit IPS > Signatures > All Categories To modify a signature action, right-click on the signature and choose Actions © 2009 Cisco Learning Institute. 71
Editing Signature Parameters Choose the signature and click Edit Different signatures have different parameters that can be modified: • Signature ID • Sub Signature ID • Alert Severity • Sig Description • Engine • Event Counter • Alert Frequency • Status © 2009 Cisco Learning Institute. 72
Using CLI Commands The show ip ips privileged EXEC command can be used with several other parameters to provide specific IPS information. •The show ip ips all command displays all IPS configuration data. •The show ip ips configuration command displays additional configuration data that is not displayed with the show running- config command. •The show ip ips interface command displays interface configuration data. The output from this command shows inbound and outbound rules applied to specific interfaces. © 2009 Cisco Learning Institute. 73
Using CLI Commands • The show ip ips signature verifies the signature configuration. The command can also be used with the key word detail to provide more explicit output • The show ip ips statistics command displays the number of packets audited and the number of alarms sent. The optional reset keyword resets output to reflect the latest statistics. Use the clear ip ips configuration command to remove all IPS configuration entries, and release dynamic resources. The clear ip ips statistics command resets statistics on packets analyzed and alarms sent. © 2009 Cisco Learning Institute. 74
Using SDM Choose Configure > Intrusion Prevention > Edit IPS All of the interfaces on the router display showing if they are enabled or disabled © 2009 Cisco Learning Institute. 75
Reporting IPS Intrusion Alerts • To specify the method of event notification, use the ip ips notify [log | sdee] global configuration command. - The log keyword sends messages in syslog format. - The sdee keyword sends messages in SDEE format. R1# config t R1(config)# logging 192.168.10.100 R1(config)# ip ips notify log R1(config)# logging on R1(config)# © 2009 Cisco Learning Institute. 76
SDEE on an IOS IPS Router • Enable SDEE on an IOS IPS router using the following command: R1# config t R1(config)# ip http server R1(config)# ip http secure-server R1(config)# ips notify sdee R1(config)# ip sdee events 500 R1(config)# • Enable HTTP or HTTPS on the router • SDEE uses a pull mechanism • Additional commands: - ip sdee events events - Clear ip ips sdee {events|subscription} - ip ips notify © 2009 Cisco Learning Institute. 77
Using SDM to View Messages To view SDEE alarm messages, choose Monitor > Logging > SDEE Message Log To view Syslog messages, choose Monitor > Logging > Syslog © 2009 Cisco Learning Institute. 78
© 2009 Cisco Learning Institute. 79

More Related Content

PDF
CCNAv5 - S3: Chapter1 Introduction to Scaling Networks
Vuz Dở Hơi
 
PPTX
CCNA Product Overview.pptx
KISHOYIANKISH
 
PPTX
CCNA 1 Routing and Switching v5.0 Chapter 1
Nil Menon
 
PPTX
Internet Protocol Version 4
Purushottam Kamble
 
PPTX
CCNA 2 Routing and Switching v5.0 Chapter 11
Nil Menon
 
PDF
CISSP Prep: Ch 5. Communication and Network Security (Part 1)
Sam Bowne
 
PPT
Securite informatique
Souhaib El
 
PPTX
Firewall
trilokchandra prakash
 
CCNAv5 - S3: Chapter1 Introduction to Scaling Networks
Vuz Dở Hơi
 
CCNA Product Overview.pptx
KISHOYIANKISH
 
CCNA 1 Routing and Switching v5.0 Chapter 1
Nil Menon
 
Internet Protocol Version 4
Purushottam Kamble
 
CCNA 2 Routing and Switching v5.0 Chapter 11
Nil Menon
 
CISSP Prep: Ch 5. Communication and Network Security (Part 1)
Sam Bowne
 
Securite informatique
Souhaib El
 
Firewall
trilokchandra prakash
 

What's hot (20)

PDF
SIP - The Basics
Jonas Borjesson
 
PPT
Data encryption standard
Vasuki Ramasamy
 
PPTX
ENSA_Module_8.pptx
JoseLopez1854
 
PPT
Network Security - Layer 2
samis
 
PPTX
CCNA 1 Routing and Switching v5.0 Chapter 2
Nil Menon
 
PDF
6.5.1.2 packet tracer layer 2 security instructor
Salem Trabelsi
 
PPTX
RC 4
Sovan Paul
 
PPTX
CCNA 2 Routing and Switching v5.0 Chapter 2
Nil Menon
 
PPT
CCNA Advanced Routing Protocols
Dsunte Wilson
 
PDF
CCNAv5 - S1: Chapter 4 - Network Access
Vuz Dở Hơi
 
PPTX
CCNA 2 Routing and Switching v5.0 Chapter 4
Nil Menon
 
PPTX
CCNA 1 Routing and Switching v5.0 Chapter 3
Nil Menon
 
PPTX
Introduction to Bluetooth Low Energy
yeokm1
 
PDF
CCNAv5 - S2: Chapter2 Basic Switching Concepts and Configuration
Vuz Dở Hơi
 
PPTX
Chapter 10 : Application layer
teknetir
 
PPTX
CCNA 2 Routing and Switching v5.0 Chapter 5
Nil Menon
 
PPTX
CCNA 1 Routing and Switching v5.0 Chapter 4
Nil Menon
 
PPTX
Router configuration in packet tracer
Anabia Anabia
 
PDF
05c reseaux-sans-fil
Cherboub Eifore
 
PPTX
CCNA Introduction to Networks Module 1
AbhayPatidar13
 
SIP - The Basics
Jonas Borjesson
 
Data encryption standard
Vasuki Ramasamy
 
ENSA_Module_8.pptx
JoseLopez1854
 
Network Security - Layer 2
samis
 
CCNA 1 Routing and Switching v5.0 Chapter 2
Nil Menon
 
6.5.1.2 packet tracer layer 2 security instructor
Salem Trabelsi
 
RC 4
Sovan Paul
 
CCNA 2 Routing and Switching v5.0 Chapter 2
Nil Menon
 
CCNA Advanced Routing Protocols
Dsunte Wilson
 
CCNAv5 - S1: Chapter 4 - Network Access
Vuz Dở Hơi
 
CCNA 2 Routing and Switching v5.0 Chapter 4
Nil Menon
 
CCNA 1 Routing and Switching v5.0 Chapter 3
Nil Menon
 
Introduction to Bluetooth Low Energy
yeokm1
 
CCNAv5 - S2: Chapter2 Basic Switching Concepts and Configuration
Vuz Dở Hơi
 
Chapter 10 : Application layer
teknetir
 
CCNA 2 Routing and Switching v5.0 Chapter 5
Nil Menon
 
CCNA 1 Routing and Switching v5.0 Chapter 4
Nil Menon
 
Router configuration in packet tracer
Anabia Anabia
 
05c reseaux-sans-fil
Cherboub Eifore
 
CCNA Introduction to Networks Module 1
AbhayPatidar13
 
Ad

Viewers also liked (20)

PPT
CCNA Security 011- implementing ios-based ips
Ahmed Habib
 
PPTX
OSPF v3
Irsandi Hasan
 
PPT
CCNA Security - Chapter 9
Irsandi Hasan
 
PPT
ITE - Chapter 9
Irsandi Hasan
 
PPT
CCNA Security - Chapter 7
Irsandi Hasan
 
PPT
CCNA Security - Chapter 8
Irsandi Hasan
 
PPTX
VMware vShield - Overview
Irsandi Hasan
 
PPT
CCNA Security - Chapter 4
Irsandi Hasan
 
PPT
CCNA Security - Chapter 6
Irsandi Hasan
 
PPT
CCNA Security 09- ios firewall fundamentals
Ahmed Habib
 
PPT
ITE - Chapter 2
Irsandi Hasan
 
PPT
CCNA Discovery 1 - Chapter 4
Irsandi Hasan
 
PPT
CCNA Security 010-configuring cisco asa
Ahmed Habib
 
PPT
CCNA Security 012- cryptographic systems
Ahmed Habib
 
PPT
CCNA Security - Chapter 3
Irsandi Hasan
 
PPT
CCNA Exploration 4 - Chapter 7
Irsandi Hasan
 
PPT
CCNA Exploration 4 - Chapter 8
Irsandi Hasan
 
PPT
CCNA Security 06- AAA
Ahmed Habib
 
PPTX
CCNA RS_NB - Chapter 8
Irsandi Hasan
 
PPT
CCNA Discovery 1 - Chapter 1
Irsandi Hasan
 
CCNA Security 011- implementing ios-based ips
Ahmed Habib
 
OSPF v3
Irsandi Hasan
 
CCNA Security - Chapter 9
Irsandi Hasan
 
ITE - Chapter 9
Irsandi Hasan
 
CCNA Security - Chapter 7
Irsandi Hasan
 
CCNA Security - Chapter 8
Irsandi Hasan
 
VMware vShield - Overview
Irsandi Hasan
 
CCNA Security - Chapter 4
Irsandi Hasan
 
CCNA Security - Chapter 6
Irsandi Hasan
 
CCNA Security 09- ios firewall fundamentals
Ahmed Habib
 
ITE - Chapter 2
Irsandi Hasan
 
CCNA Discovery 1 - Chapter 4
Irsandi Hasan
 
CCNA Security 010-configuring cisco asa
Ahmed Habib
 
CCNA Security 012- cryptographic systems
Ahmed Habib
 
CCNA Security - Chapter 3
Irsandi Hasan
 
CCNA Exploration 4 - Chapter 7
Irsandi Hasan
 
CCNA Exploration 4 - Chapter 8
Irsandi Hasan
 
CCNA Security 06- AAA
Ahmed Habib
 
CCNA RS_NB - Chapter 8
Irsandi Hasan
 
CCNA Discovery 1 - Chapter 1
Irsandi Hasan
 
Ad

Similar to CCNA Security - Chapter 5 (20)

PPTX
Pass4sure 640-554 Cisco IOS Network Security
Hecrocro
 
PPT
Chapter 5 overview
ali raza
 
PPT
Ingenieria de Software Real Academia Española
pkalckbh
 
PDF
Ch5-Implementing Intrusion Prevention.pdf
OhmRon
 
PPTX
IDS n IPS
SAurabh PRajapati
 
PPTX
Intrusion prevention system(ips)
Papun Papun
 
PPTX
Intrusion Detection and Prevention Systems.pptx
SherifElGohary7
 
PPT
Secure Network Design
Conferencias FIST
 
PPT
Intrusion detection and prevention
Nicholas Davis
 
PPT
Intrusion Detection And Prevention
Nicholas Davis
 
PPTX
Cours_4_IDS_IPS.pptx
ssuserc517ee1
 
PPTX
Intrusion detection and prevention system
Nikhil Raj
 
DOCX
Intrusion Detection System
Devil's Cafe
 
PPT
Idps technology starter v2.0
Finto Thomas , CISSP, TOGAF, CCSP, ITIL. JNCIS
 
PDF
IDS (intrusion detection system)
Netwax Lab
 
PPTX
Ccna sv2 instructor_ppt_ch5
SalmenHAJJI1
 
PPTX
IDS VS IPS.pptx
Tapan Khilar
 
PPTX
04 ccna sv2 instructor_ppt_ch5
Babaa Naya
 
DOCX
Ips and-ids
Adam Viet
 
PDF
004_Cybersecurity Fundamentals Network Security.pdf
DaraputriOktiara
 
Pass4sure 640-554 Cisco IOS Network Security
Hecrocro
 
Chapter 5 overview
ali raza
 
Ingenieria de Software Real Academia Española
pkalckbh
 
Ch5-Implementing Intrusion Prevention.pdf
OhmRon
 
IDS n IPS
SAurabh PRajapati
 
Intrusion prevention system(ips)
Papun Papun
 
Intrusion Detection and Prevention Systems.pptx
SherifElGohary7
 
Secure Network Design
Conferencias FIST
 
Intrusion detection and prevention
Nicholas Davis
 
Intrusion Detection And Prevention
Nicholas Davis
 
Cours_4_IDS_IPS.pptx
ssuserc517ee1
 
Intrusion detection and prevention system
Nikhil Raj
 
Intrusion Detection System
Devil's Cafe
 
Idps technology starter v2.0
Finto Thomas , CISSP, TOGAF, CCSP, ITIL. JNCIS
 
IDS (intrusion detection system)
Netwax Lab
 
Ccna sv2 instructor_ppt_ch5
SalmenHAJJI1
 
IDS VS IPS.pptx
Tapan Khilar
 
04 ccna sv2 instructor_ppt_ch5
Babaa Naya
 
Ips and-ids
Adam Viet
 
004_Cybersecurity Fundamentals Network Security.pdf
DaraputriOktiara
 

More from Irsandi Hasan (20)

PPTX
CCNA v6.0 ITN - Chapter 11
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 10
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 09
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 08
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 07
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 06
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 05
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 04
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 03
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 02
Irsandi Hasan
 
PPTX
CCNA v6.0 ITN - Chapter 01
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 11
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 10
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 9
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 7
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 6
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 5
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 4
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 3
Irsandi Hasan
 
PPTX
CCNA RS_NB - Chapter 2
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 11
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 10
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 09
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 08
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 07
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 06
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 05
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 04
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 03
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 02
Irsandi Hasan
 
CCNA v6.0 ITN - Chapter 01
Irsandi Hasan
 
CCNA RS_NB - Chapter 11
Irsandi Hasan
 
CCNA RS_NB - Chapter 10
Irsandi Hasan
 
CCNA RS_NB - Chapter 9
Irsandi Hasan
 
CCNA RS_NB - Chapter 7
Irsandi Hasan
 
CCNA RS_NB - Chapter 6
Irsandi Hasan
 
CCNA RS_NB - Chapter 5
Irsandi Hasan
 
CCNA RS_NB - Chapter 4
Irsandi Hasan
 
CCNA RS_NB - Chapter 3
Irsandi Hasan
 
CCNA RS_NB - Chapter 2
Irsandi Hasan
 

CCNA Security - Chapter 5

  • 1. CCNA Security Chapter Five Implementing Intrusion Prevention © 2009 Cisco Learning Institute. 1
  • 2. Lesson Planning • This lesson should take 3-6 hours to present • The lesson should include lecture, demonstrations, discussion and assessments • The lesson can be taught in person or using remote instruction © 2009 Cisco Learning Institute. 2
  • 3. Major Concepts • Describe the purpose and operation of network- based and host-based Intrusion Prevention Systems (IPS) • Describe how IDS and IPS signatures are used to detect malicious network traffic • Implement Cisco IOS IPS operations using CLI and SDM • Verify and monitor the Cisco IOS IPS operations using CLI and SDM © 2009 Cisco Learning Institute. 3
  • 4. Lesson Objectives Upon completion of this lesson, the successful participant will be able to: 1. Describe the functions and operations of IDS and IPS systems 2. Introduce the two methods of implementing IPS and describe host based IPS 3. Describe network-based intrusion prevention 4. Describe the characteristics of IPS signatures 5. Describe the role of signature alarms (triggers) in Cisco IPS solutions 6. Describe the role of tuning signature alarms (triggers) in a Cisco IPS solution © 2009 Cisco Learning Institute. 4
  • 5. Lesson Objectives 7. Describe the role of signature actions in a Cisco IPS solution 8. Describe the role of signature monitoring in a Cisco IPS solution 9. Describe how to configure Cisco IOS IPS Using CLI 10. Describe how to configure Cisco IOS IPS using Cisco SDM 11. Describe how to modify IPS signatures in CLI and SDM 12. Describe how to verify the Cisco IOS IPS configuration 13. Describe how to monitor the Cisco IOS IPS events 14. Describe how to troubleshoot the Cisco IOS IPS events © 2009 Cisco Learning Institute. 5
  • 6. Common Intrusions MARS ACS VPN Zero-day exploit Remote Worker attacking the network Firewall VPN VPN Iron Port Remote Branch LAN CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 6
  • 7. Intrusion Detection Systems (IDSs) 1. An attack is launched on a network that has a sensor deployed in promiscuous IDS mode; therefore copies of all packets are sent to the IDS sensor for packet analysis. However, the target machine will Switch experience the malicious attack. 1 2. The IDS sensor, matches the malicious traffic to a signature and sends the switch a command to 2 deny access to the source of the malicious traffic. Sensor 3. The IDS can also send an alarm to a management console for logging 3 and other management purposes. Management Target Console © 2009 Cisco Learning Institute. 7
  • 8. Intrusion Prevention Systems (IPSs) 1 1. An attack is launched on a network that has a sensor deployed in IPS mode (inline mode). 2. The IPS sensor analyzes the packets as they enter the IPS sensor interface. The IPS sensor matches the malicious traffic to a 2 signature and the attack is stopped Sensor 4 immediately. 3. The IPS sensor can also send an alarm to a management console for logging and other management Bit Bucket purposes. 4. Traffic in violation of policy can be 3 dropped by an IPS sensor. Target Management Console © 2009 Cisco Learning Institute. 8
  • 9. Common characteristics of IDS and IPS  Both technologies are deployed using sensors.  Both technologies use signatures to detect patterns of misuse in network traffic.  Both can detect atomic patterns (single- packet) or composite patterns (multi- packet). © 2009 Cisco Learning Institute. 9
  • 10. Comparing IDS and IPS Solutions Advantages Disadvantages  Response action cannot  No impact on network stop trigger packets Promiscuous Mode (latency, jitter)  Correct tuning required for  No network impact if there is a response actions IDS sensor failure  Must have a well thought-  No network impact if there is out security policy sensor overload  More vulnerable to network evasion techniques © 2009 Cisco Learning Institute. 10
  • 11. Comparing IDS and IPS Solutions Advantages Disadvantages  Sensor issues might affect network traffic Inline Mode  Sensor overloading  Stops trigger packets impacts the network IPS  Can use stream normalization  Must have a well thought- techniques out security policy  Some impact on network (latency, jitter) © 2009 Cisco Learning Institute. 11
  • 12. Network-Based Implementation CSA MARS VPN Remote Worker Firewall VPN IPS CSA VPN Iron Port Remote Branch CSA CSA CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 12
  • 13. Host-Based Implementation CSA CSA MARS VPN Management Center for Remote Worker Cisco Security Agents Firewall VPN IPS CSA VPN Agent Iron Port Remote Branch CSA CSA CSA CSA CSA CSA Web Email Server Server DNS © 2009 Cisco Learning Institute. 13
  • 14. Cisco Security Agent Corporate Network Application Server Agent Agent Firewall Untrusted Network Agent Agent Agent Agent SMTP Agent Agent Agent Server Web DNS Server Server Management Center for Cisco Security Agents video © 2009 Cisco Learning Institute. 14
  • 15. Cisco Security Agent Screens A warning message appears when CSA detects a Problem. CSA maintains a log file allowing the user to verify problems and A waving flag in the learn more information. system tray indicates a potential security problem. © 2009 Cisco Learning Institute. 15
  • 16. Host-Based Solutions Advantages and Disadvantages of HIPS Advantages Disadvantages  The  HIPS does not provide a success or complete network picture. failure of an attack can  HIPS has a requirement to be readily support multiple operating determined. systems.  HIPS does not have to worry about fragmentati on attacks or variable Time to Live (TTL) attacks. © 2009 Cisco Learning Institute. 16
  • 17. Network-Based Solutions Corporate Network Sensor Firewall Router Untrusted Network Sensor Management Server Sensor Web DNS Server Server © 2009 Cisco Learning Institute. 17
  • 18. Cisco IPS Solutions AIM and Network Module Enhanced • Integrates IPS into the Cisco 1841 (IPS AIM only), 2800 and 3800 ISR routers • IPS AIM occupies an internal AIM slot on router and has its own CPU and DRAM • Monitors up to 45 Mb/s of traffic • Provides full-featured intrusion protection • Is able to monitor traffic from all router interfaces • Can inspect GRE and IPsec traffic that has been decrypted at the router • Delivers comprehensive intrusion protection at branch offices, isolating threats from the corporate network • Runs the same software image as Cisco IPS Sensor Appliances © 2009 Cisco Learning Institute. 18
  • 19. Cisco IPS Solutions ASA AIP-SSM • High-performance module designed to provide additional security services to the Cisco ASA 5500 Series Adaptive Security Appliance • Diskless design for improved reliability • External 10/100/1000 Ethernet interface for management and software downloads • Intrusion prevention capability • Runs the same software image as the Cisco IPS Sensor appliances © 2009 Cisco Learning Institute. 19
  • 20. Cisco IPS Solutions 4200 Series Sensors • Appliance solution focused on protecting network devices, services, and applications • Sophisticated attack detection is provided. © 2009 Cisco Learning Institute. 20
  • 21. Cisco IPS Solutions Cisco Catalyst 6500 Series IDSM-2 • Switch-integrated intrusion protection module delivering a high-value security service in the core network fabric device • Support for an unlimited number of VLANs • Intrusion prevention capability • Runs the same software image as the Cisco IPS Sensor Appliances © 2009 Cisco Learning Institute. 21
  • 22. IPS Sensors • Factors that impact IPS sensor selection and deployment: - Amount of network traffic - Network topology - Security budget - Available security staff • Size of implementation - Small (branch offices) - Large - Enterprise © 2009 Cisco Learning Institute. 22
  • 23. Comparing HIPS and Network IPS Advantages Disadvantages  Is host-specific  Operating system dependent  Protects host after decryption HIPS  Lower level network events  Provides application-level not seen encryption protection  Host is visible to attackers  Is cost-effective  Cannot examine encrypted traffic  Not visible on the network  Does not know whether an Network Operating system  attack was successful IPS independent  Lower level network events seen © 2009 Cisco Learning Institute. 23
  • 24. Signature Characteristics • An IDS or IPS sensor Hey, come look at this. This matches a signature with looks like the signature of a a data flow LAND attack. • The sensor takes action • Signatures have three distinctive attributes - Signature type - Signature trigger - Signature action © 2009 Cisco Learning Institute. 24
  • 25. Signature Types • Atomic - Simplest form - Consists of a single packet, activity, or event - Does not require intrusion system to maintain state information - Easy to identify • Composite - Also called a stateful signature - Identifies a sequence of operations distributed across multiple hosts - Signature must maintain a state known as the event horizon © 2009 Cisco Learning Institute. 25
  • 26. Signature File © 2009 Cisco Learning Institute. 26
  • 27. Signature Micro-Engines Version 4.x Version 5.x Description SME Prior 12.4(11)T Atomic – Examine simple packets SME 12.4(11)T and later ATOMIC.IP ATOMIC.IP Provides simple Layer 3 IP alarms Provides simple Internet Control Message Protocol (ICMP) alarms based on the following parameters: type, code, ATOMIC.ICMP ATOMIC.IP sequence, and ID ATOMIC.IPOPTIONS ATOMIC.IP Provides simple alarms based on the decoding of Layer 3 options Provides simple User Datagram Protocol (UDP) packet alarms based on the following parameters: port, direction, and ATOMIC.UDP ATOMIC.IP data length ATOMIC.TCP Service – Examine the many services that are attacked ATOMIC.IP Provides simple TCP packet alarms based on the following parameters: port, destination, and flags SERVICE.DNS SERVICE.DNS Analyzes the Domain Name System (DNS) service SERVICE.RPC SERVICE.RPC Analyzes the remote-procedure call (RPC) service SERVICE.SMTP STATE Inspects Simple Mail Transfer Protocol (SMTP) SERVICE.HTTP SERVICE.HTTP Provides HTTP protocol decode-based string engine that includes ant evasive URL de-obfuscation SERVICE.FTP String – Use expression-based patterns to detect intrusions SERVICE.FTP Provides FTP service special decode alarms STRING.TCP STRING.TCP Offers TCP regular expression-based pattern inspection engine services STRING.UDP STRING.UDP Offers UDP regular expression-based pattern inspection engine services STRING.ICMP Multi-String Supports flexible pattern matching STRING.ICMP Provides ICMP regular expression-based pattern inspection engine services MULTI-STRING MULTI-STRING Supports flexible pattern matching and supports Trend Labs signatures OTHER NORMALIZER Provides internal engine to handle miscellaneous signatures Other – Handles miscellaneous signatures © 2009 Cisco Learning Institute. 27
  • 28. Cisco Signature List © 2009 Cisco Learning Institute. 28
  • 29. Signature Triggers Advantages Disadvantages • Easy configuration • No detection of unknown signatures Pattern-based • Fewer false positives • Initially a lot of false positives Detection • Good signature design • Signatures must be created, updated, and tuned • Simple and reliable • Generic output Anomaly- based • Customized policies • Policy must be created Detection • Can detect unknown attacks • Easy configuration • Difficult to profile typical activity in large Policy-based networks • Can detect unknown attacks Detection • Traffic profile must be constant • Window to view attacks • Dedicated honey pot server Honey Pot- • Distract and confuse attackers • Honey pot server must not be trusted Based • Slow down and avert attacks Detection • Collect information about attack © 2009 Cisco Learning Institute. 29
  • 30. Pattern-based Detection Signature Type Trigger Atomic Signature Stateful Signature No state required to Must maintain state or examine Pattern- examine pattern to multiple items to determine if based determine if signature signature action should be detection action should be applied applied Detecting for an Address Searching for the string Resolution Protocol confidential across multiple Example (ARP) request that has a packets in a TCP session source Ethernet address of FF:FF:FF:FF:FF:FF © 2009 Cisco Learning Institute. 30
  • 31. Anomaly-based Detection Signature Type Trigger Atomic Signature Stateful Signature No state required to Anomaly- State required to identify identify activity that based activity that deviates from deviates from normal detection normal profile profile Detecting traffic that is going to a destination port Verifying protocol compliance Example that is not in the normal for HTTP traffic profile © 2009 Cisco Learning Institute. 31
  • 32. Policy-based Detection Signature Type Signature Trigger Atomic Signature Stateful Signature Policy- No state required to Previous activity (state) based identify undesirable required to identify undesirable detection behavior behavior Detecting abnormally A SUN Unix host sending RPC large fragmented packets requests to remote hosts Example by examining only the last without initially consulting the fragment SUN PortMapper program. © 2009 Cisco Learning Institute. 32
  • 33. Honey Pot-based Detection • Uses a dummy server to attract attacks • Distracts attacks away from real network devices • Provides a means to analyze incoming types of attacks and malicious traffic patterns • Is useful for finding common attacks on network resources and implementing patches/fixes for real network purposes © 2009 Cisco Learning Institute. 33
  • 34. Cisco IOS IPS Solution Benefits • Uses the underlying routing infrastructure to provide an additional layer of security with investment protection • Attacks can be effectively mitigated to deny malicious traffic from both inside and outside the network • Provides threat protection at all entry points to the network when combined with other Cisco solutions • Is supported by easy and effective management tools • Offers pervasive intrusion prevention solutions that are designed to integrate smoothly into the network infrastructure and to proactively protect vital resources • Supports approximately 2000 attack signatures from the same signature database that is available for Cisco IPS appliances © 2009 Cisco Learning Institute. 34
  • 35. Signature Alarms Alarm Type Network Activity IPS Activity Outcome Alarm False positive Normal user traffic Tune alarm generated No alarm False negative Attack traffic Tune alarm generated Alarm Ideal True positive Attack traffic generated setting No alarm Ideal True negative Normal user traffic generated setting © 2009 Cisco Learning Institute. 35
  • 36. Signature Tuning Levels Informational – Activity that triggers the signature High –an-immediate threat, but the information DoS Medium Abnormal networkaccess detected, a could is not– Abnormal network activity is or cause Low Attacks used to gain activity is detected, attack are detected (immediate threat likely be malicious, and immediate threat is extremely likely could provided is useful be malicious, and immediate threat is not likely © 2009 Cisco Learning Institute. 36
  • 37. Generating an Alert Specific Alert Description This action writes the event to the Event Store as Produce alert an alert. Produce verbose This action includes an encoded dump of the alert offending packet in the alert. © 2009 Cisco Learning Institute. 37
  • 38. Logging the Activity Specific Alert Description This action starts IP logging on packets that Log attacker contain the attacker address and sends an packets alert. This action starts IP logging on packets that Log pair packets contain the attacker and victim address pair. Log victim This action starts IP logging on packets that packets contain the victim address and sends an alert. © 2009 Cisco Learning Institute. 38
  • 39. Dropping/Preventing the Activity Specific Alert Description • Terminates the current packet and future packets from this attacker address for a period of time. • The sensor maintains a list of the attackers currently being denied by the system. Deny attacker • Entries may be removed from the list manually or inline wait for the timer to expire. • The timer is a sliding timer for each entry. • If the denied attacker list is at capacity and cannot add a new entry, the packet is still denied. Deny connection •Terminates the current packet and future packets inline on this TCP flow. Deny packet •Terminates the packet. inline © 2009 Cisco Learning Institute. 39
  • 40. Resetting a TCP Connection/Blocking Activity/Allowing Activity Specific Category Description Alert Resetting a Reset TCP • Sends TCP resets to hijack and terminate the TCP connection TCP flow connection Request • This action sends a request to a blocking block device to block this connection. connection Blocking Request • This action sends a request to a blocking future block host device to block this attacker host. activity • Sends a request to the notification application Request component of the sensor to perform SNMP SNMP trap notification. Allowing • Allows administrator to define exceptions to Activity configured signatures © 2009 Cisco Learning Institute. 40
  • 41. Planning a Monitoring Strategy The MARS appliance detected and mitigated the ARP poisoning attack. There are four factors to There are four factors to consider when planning a consider when planning a monitoring strategy. monitoring strategy. ••Management method Management method ••Event correlation Event correlation ••Security staff Security staff ••Incident response plan Incident response plan © 2009 Cisco Learning Institute. 41
  • 42. MARS The security operator examines The security operator examines the output generated by the the output generated by the MARS appliance: MARS appliance: ••MARS is used to centrally MARS is used to centrally manage all IPS sensors. manage all IPS sensors. ••MARS is used to correlate all MARS is used to correlate all of the IPS and Syslog events of the IPS and Syslog events in a central location. in a central location. ••The security operator must The security operator must proceed according to the proceed according to the incident response plan incident response plan identified in the Network identified in the Network Security Policy. Security Policy. © 2009 Cisco Learning Institute. 42
  • 43. Cisco IPS Solutions • Locally Managed Solutions: - Cisco Router and Security Device Manager (SDM) - Cisco IPS Device Manager (IDM) • Centrally Managed Solutions: - Cisco IDS Event Viewer (IEV) - Cisco Security Manager (CSM) - Cisco Security Monitoring, Analysis, and Response System (MARS) © 2009 Cisco Learning Institute. 43
  • 44. Cisco Router and Security Device Manager Monitors and prevents intrusions by comparing traffic against signatures of known threats and blocking the traffic when a threat is detected Lets administrators control the application of Cisco IOS IPS on interfaces, import and edit signature definition files (SDF) from Cisco.com, and configure the action that Cisco IOS IPS is to take if a threat is detected © 2009 Cisco Learning Institute. 44
  • 45. Cisco IPS Device Manager • A web-based configuration tool • Shipped at no additional cost with the Cisco IPS Sensor Software • Enables an administrator to configure and manage a sensor • The web server resides on the sensor and can be accessed through a web browser © 2009 Cisco Learning Institute. 45
  • 46. Cisco IPS Event Viewer • View and manage alarms for up to five sensors • Connect to and view alarms in real time or in imported log files • Configure filters and views to help you manage the alarms. • Import and export event data for further analysis. © 2009 Cisco Learning Institute. 46
  • 47. Cisco Security Manager • Powerful, easy-to-use solution to centrally provision all aspects of device configurations and security policies for Cisco firewalls, VPNs, and IPS • Support for IPS sensors and Cisco IOS IPS • Automatic policy-based IPS sensor software and signature updates • Signature update wizard © 2009 Cisco Learning Institute. 47
  • 48. Cisco Security Monitoring Analytic and Response System • An appliance-based, all- inclusive solution that allows network and security administrators to monitor, identify, isolate, and counter security threats • Enables organizations to more effectively use their network and security resources. • Works in conjunction with Cisco CSM. © 2009 Cisco Learning Institute. 48
  • 49. Secure Device Event Exchange Network Alarm Management SDEE Protocol Console Alarm Syslog Syslog Server • The SDEE format was developed to improve communication of events generated by security devices • Allows additional event types to be included as they are defined © 2009 Cisco Learning Institute. 49
  • 50. Best Practices • The need to upgrade sensors with the latest signature packs must be balanced against the momentary downtime. • When setting up a large deployment of sensors, automatically update signature packs rather than manually upgrading every sensor. • When new signature packs are available, download the new signature packs to a secure server within the management network. Use another IPS to protect this server from attack by an outside party. • Place the signature packs on a dedicated FTP server within the management network. If a signature update is not available, a custom signature can be created to detect and mitigate a specific attack. © 2009 Cisco Learning Institute. 50
  • 51. Best Practices • Configure the FTP server to allow read-only access to the files within the directory on which the signature packs are placed only from the account that the sensors will use. • Configure the sensors to automatically update the signatures by checking the FTP server for the new signature packs periodically. Stagger the time of day when the sensors check the FTP server for new signature packs. • The signature levels that are supported on the management console must remain synchronized with the signature packs on the sensors themselves. © 2009 Cisco Learning Institute. 51
  • 52. Overview of Implementing IOS IPS I want to use CLI to manage my signature 1. Download the IOS IPS files for IPS. I have files downloaded the IOS IPS files. 2. Create an IOS IPS configuration directory on Flash 3. Configure an IOS IPS crytpo key 4. Enable IOS IPS 5. Load the IOS IPS Signature Package to the router © 2009 Cisco Learning Institute. 52
  • 53. 1. Download the Signature File Download IOS IPS signature package files and public crypto key © 2009 Cisco Learning Institute. 53
  • 54. 2. Create Directory R1# mkdir ips Create directory filename [ips]? Created dir flash:ips R1# R1# dir flash: Directory of flash:/ 5 -rw- 51054864 Jan 10 2009 15:46:14 -08:00 c2800nm-advipservicesk9-mz.124-20.T1.bin 6 drw- 0 Jan 15 2009 11:36:36 -08:00 ips 64016384 bytes total (12693504 bytes free) R1# To rename a directory: R1# rename ips ips_new Destination filename [ips_new]? R1# © 2009 Cisco Learning Institute. 54
  • 55. 3. Configure the Crypto Key 1 2 R1# conf t R1(config)# 1 – Highlight and copy the text contained in the public key file. 2 – Paste it in global configuration mode. © 2009 Cisco Learning Institute. 55
  • 56. Confirm the Crypto Key R1# show run <Output omitted> crypto key pubkey-chain rsa named-key realm-cisco.pub signature key-string 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101 00C19E93 A8AF124A D6CC7A24 5097A975 206BE3A2 06FBA13F 6F12CB5B 4E441F16 17E630D5 C02AC252 912BE27F 37FDD9C8 11FC7AF7 DCDD81D9 43CDABC3 6007D128 B199ABCB D34ED0F9 085FADC1 359C189E F30AF10A C0EFB624 7E0764BF 3E53053E 5B2146A9 D7A5EDE3 0298AF03 DED7A5B8 9479039D 20F30663 9AC64B93 C0112A35 FE3F0C87 89BCB7BB 994AE74C FA9E481D F65875D6 85EAF974 6D9CC8E3 F0B08B85 50437722 FFBE85B9 5E4189FF CC189CB9 69C46F9C A84DFBA5 7A0AF99E AD768C36 006CF498 079F88F8 A3B3FB1F 9FB7B3CB 5539E1D1 9693CCBB 551F78D2 892356AE 2F56D826 8918EF3C 80CA4F4D 87BFCA3B BFF668E9 689782A5 CF31CB6E B4B094D3 F3020301 0001 <Output omitted> © 2009 Cisco Learning Institute. 56
  • 57. 4. Enable IOS IPS R1(config)# ip ips name iosips 1 R1(config)# ip ips name ips list ? 1 – IPS rule is created <1-199> Numbered access list WORD Named access list 2 R1(config)# 2 – IPS location in flash identified R1(config)# ip ips config location flash:ips R1(config)# R1(config)# ip http server R1(config)# ip ips notify sdee 3 R1(config)# ip ips notify log R1(config)# 3 – SDEE and Syslog notification are enabled © 2009 Cisco Learning Institute. 57
  • 58. 4. Enable IOS IPS R1(config)# ip ips signature-category R1(config-ips-category)# category all 1 – The IPS all category is retired 1 R1(config-ips-category-action)# retired true R1(config-ips-category-action)# exit R1(config-ips-category)# 2 – The IPS basic category is unretired. R1(config-ips-category)# category ios_ips basic 2 R1(config-ips-category-action)# retired false R1(config-ips-category-action)# exit R1(config-ips-category)# exit Do you want to accept these changes? [confirm] y R1(config)# R1(config)# interface GigabitEthernet 0/1 R1(config-if)# ip ips iosips in 3 R1(config-if)# exit 3 – The IPS rule is applied in a incoming direction R1(config)#exit R1(config)# interface GigabitEthernet 0/1 4 R1(config-if)# ip ips iosips in R1(config-if)# ip ips iosips out R1(config-if)# exit R1(config)# exit 4 – The IPS rule is applied in an incoming and outgoing direction. © 2009 Cisco Learning Institute. 58
  • 59. 5. Load Signature Package 1 – Copy the signatures from the FTP server. 1 R1# copy ftp://cisco:cisco@10.1.1.1/IOS-S376-CLI.pkg idconf Loading IOS-S310-CLI.pkg !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [OK - 7608873/4096 bytes] *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDS_STARTED: 16:44:47 PST Jan 15 2008 2 *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDING: multi-string - 8 signatures - 1 of 13 engines *Jan 15 16:44:47 PST: %IPS-6-ENGINE_READY: multi-string - build time 4 ms - packets for this engine will be scanned *Jan 15 16:44:47 PST: %IPS-6-ENGINE_BUILDING: service-http - 622 signatures - 2 of 13 engines *Jan 15 16:44:53 PST: %IPS-6-ENGINE_READY: service-http - build time 6024 ms - packets for this engine will be scanned <Output omitted> *Jan 15 16:45:18 PST: %IPS-6-ENGINE_BUILDING: service-smb-advanced - 35 signatures - 12 of 13 engines *Jan 15 16:45:18 PST: %IPS-6-ENGINE_READY: service-smb-advanced - build time 16 ms - packets for this engine will be scanned *Jan 15 16:45:18 PST: %IPS-6-ENGINE_BUILDING: service-msrpc - 25 signatures - 13 of 13 engines *Jan 15 16:45:18 PST: %IPS-6-ENGINE_READY: service-msrpc - build time 32 ms - packets for this engine will be scanned *Jan 15 16:45:18 PST: %IPS-6-ALL_ENGINE_BUILDS_COMPLETE: elapsed time 31628 ms 2 – Signature compiling begins immediately after the signature package is loaded to the router. © 2009 Cisco Learning Institute. 59
  • 60. Verify the Signature R1# show ip ips signature count Cisco SDF release version S310.0 ← signature package release version Trend SDF release version V0.0 Signature Micro-Engine: multi-string: Total Signatures 8 multi-string enabled signatures: 8 multi-string retired signatures: 8 <Output omitted> Signature Micro-Engine: service-msrpc: Total Signatures 25 service-msrpc enabled signatures: 25 service-msrpc retired signatures: 18 service-msrpc compiled signatures: 1 service-msrpc inactive signatures - invalid params: 6 Total Signatures: 2136 Total Enabled Signatures: 807 Total Retired Signatures: 1779 Total Compiled Signatures: 351 ← total compiled signatures for the IOS IPS Basic category Total Signatures with invalid parameters: 6 Total Obsoleted Signatures: 11 R1# © 2009 Cisco Learning Institute. 60
  • 61. Configuring Cisco IOS IPS in SDM Create IPS – this tab contains the IPS Rule wizard Edit IPS – this tab allows the edit of rules and apply or remove them from interfaces Security Dashboard– this tab is used to view the Top Threats table and deploy signatures IPS Migration – this tab is used to migrate configurations created in earlier versions of the IOS © 2009 Cisco Learning Institute. 61
  • 62. Using SDM 1. Choose Configure > Intrusion Prevention > Create IPS 2. Click the Launch IPS Rule Wizard button 3. Click Next © 2009 Cisco Learning Institute. 62
  • 63. Using SDM 4. Choose the router interface by checking either the Inbound or Outbound checkbox (or both) 5. Click Next © 2009 Cisco Learning Institute. 63
  • 64. Using SDM 6. Click the preferred option and fill in the appropriate text box 7. Click download for the latest signature file 8. Go to 9. Download the key to a PC www.cisco.com/pcgi-bin/tablebuild.pl/ios-v5sigup to obtain the public key 11. Copy the text between the 10. Open the key in a text editor phrase “key-string” and the and copy the text after the work “quit” into the Key field phrase “named-key” into the Name field 12. Click Next © 2009 Cisco Learning Institute. 64
  • 65. Using SDM 13. Click the ellipsis (…) button and enter config location 14. Choose the category that will allow the Cisco IOS IPS to function efficiently on the router 15. Click finish © 2009 Cisco Learning Institute. 65
  • 66. SDM IPS Wizard Summary © 2009 Cisco Learning Institute. 66
  • 67. Generated CLI Commands R1# show run <Output omitted> ip ips name sdm_ips_rule ip ips config location flash:/ipsdir/ retries 1 ip ips notify SDEE ! ip ips signature-category category all retired true category ios_ips basic retired false ! interface Serial0/0/0 ip ips sdm_ips_rule in ip virtual-reassembly <Output omitted> © 2009 Cisco Learning Institute. 67
  • 68. Using CLI Commands R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-definition R1(config-sigdef)# signature 6130 10 This example shows how R1(config-sigdef-sig)# status R1(config-sigdef-sig-status)# retired true to retire individual R1(config-sigdef-sig-status)# exit signatures. In this case, R1(config-sigdef-sig)# exit R1(config-sigdef)# exit signature 6130 with subsig Do you want to accept these changes? [confirm] y ID of 10. R1(config)# R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-category R1(config-ips-category)# category ios_ips basic This example shows how R1(config-ips-category-action)# retired false R1(config-ips-category-action)# exit to unretire all signatures R1(config-ips-category)# exit that belong to the IOS IPS Do you want to accept these changes? [confirm] y R1(config)# Basic category. © 2009 Cisco Learning Institute. 68
  • 69. Using CLI Commands for Changes R1# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)# ip ips signature-definition R1(config-sigdef)# signature 6130 10 R1(config-sigdef-sig)# engine R1(config-sigdef-sig-engine)# event-action produce-alert R1(config-sigdef-sig-engine)# event-action deny-packet-inline R1(config-sigdef-sig-engine)# event-action reset-tcp-connection R1(config-sigdef-sig-engine)# exit R1(config-sigdef-sig)# exit R1(config-sigdef)# exit This example shows how to Do you want to accept these changes? [confirm] y R1(config)# change signature actions to alert, drop, and reset for signature 6130 with subsig ID of 10. © 2009 Cisco Learning Institute. 69
  • 70. Viewing Configured Signatures Choose Configure > Intrusion Prevention > Edit IPS > Signatures > All Categories Filter the signature list according to type To modify a signature, right- click on the signature then choose an option from the pop-up © 2009 Cisco Learning Institute. 70
  • 71. Modifying Signature Actions To tune a signature, choose Configure > Intrusion Prevention > Edit IPS > Signatures > All Categories To modify a signature action, right-click on the signature and choose Actions © 2009 Cisco Learning Institute. 71
  • 72. Editing Signature Parameters Choose the signature and click Edit Different signatures have different parameters that can be modified: • Signature ID • Sub Signature ID • Alert Severity • Sig Description • Engine • Event Counter • Alert Frequency • Status © 2009 Cisco Learning Institute. 72
  • 73. Using CLI Commands The show ip ips privileged EXEC command can be used with several other parameters to provide specific IPS information. •The show ip ips all command displays all IPS configuration data. •The show ip ips configuration command displays additional configuration data that is not displayed with the show running- config command. •The show ip ips interface command displays interface configuration data. The output from this command shows inbound and outbound rules applied to specific interfaces. © 2009 Cisco Learning Institute. 73
  • 74. Using CLI Commands • The show ip ips signature verifies the signature configuration. The command can also be used with the key word detail to provide more explicit output • The show ip ips statistics command displays the number of packets audited and the number of alarms sent. The optional reset keyword resets output to reflect the latest statistics. Use the clear ip ips configuration command to remove all IPS configuration entries, and release dynamic resources. The clear ip ips statistics command resets statistics on packets analyzed and alarms sent. © 2009 Cisco Learning Institute. 74
  • 75. Using SDM Choose Configure > Intrusion Prevention > Edit IPS All of the interfaces on the router display showing if they are enabled or disabled © 2009 Cisco Learning Institute. 75
  • 76. Reporting IPS Intrusion Alerts • To specify the method of event notification, use the ip ips notify [log | sdee] global configuration command. - The log keyword sends messages in syslog format. - The sdee keyword sends messages in SDEE format. R1# config t R1(config)# logging 192.168.10.100 R1(config)# ip ips notify log R1(config)# logging on R1(config)# © 2009 Cisco Learning Institute. 76
  • 77. SDEE on an IOS IPS Router • Enable SDEE on an IOS IPS router using the following command: R1# config t R1(config)# ip http server R1(config)# ip http secure-server R1(config)# ips notify sdee R1(config)# ip sdee events 500 R1(config)# • Enable HTTP or HTTPS on the router • SDEE uses a pull mechanism • Additional commands: - ip sdee events events - Clear ip ips sdee {events|subscription} - ip ips notify © 2009 Cisco Learning Institute. 77
  • 78. Using SDM to View Messages To view SDEE alarm messages, choose Monitor > Logging > SDEE Message Log To view Syslog messages, choose Monitor > Logging > Syslog © 2009 Cisco Learning Institute. 78
  • 79. © 2009 Cisco Learning Institute. 79

Editor's Notes

  • #72: Deny Attacker Inline : Create an ACL that denies all traffic from the IP address that is considered the source of the attack by the Cisco IOS IPS system. Deny Connection Inline : Drop the packet and all future packets from this TCP flow. Deny Packet Inline : Do not transmit this packet (inline only). Produce Alert : Generate an alarm message. Reset TCP Connection : Send TCP resets to terminate the TCP flow.
  • #77: This graphic needs some explanatory text.