SIC JOURNAL TYIT
PRACTICAL NO 7: Configure IOS Intrusion
Prevention System (IPS) Using the CLI
The Cisco IOS IPS acts as an in-line intrusion prevention sensor, watching packets and
sessions as they flow through the router and scanning each packet to match any of the Cisco
IOS IPS signatures. When it detects suspicious activity, it responds before network security can
be compromised and logs the event through Cisco IOS syslog messages or Security Device
Event Exchange (SDEE). The network administrator can configure Cisco IOS IPS to choose the
appropriate response to various threats. The Signature Event Action Processor (SEAP) can
dynamically control actions that are to be taken by a signature event on the basis of parameters
such as fidelity, severity, or target value rating. These parameters have default values but can
also be configured through CLI. When packets in a session match a signature, Cisco IOS IPS
can take any of the following actions, as appropriate:
1) Send an alarm to a syslog server or a centralized management interface
2) Drop the packet
3) Reset the connection
4) Deny traffic from the source IP address of the attacker for a specified amount of time
5) Deny traffic on the connection for which the signature was seen for a specified amount
of time
Cisco developed its Cisco IOS software-based intrusion-prevention capabilities and Cisco IOS
Firewall with flexibility in mind, so that individual signatures could be disabled in case of false
positives. Generally, it is preferable to enable both the firewall and Cisco IOS IPS to support
network security policies. However, each of these features may be enabled independently and
on different router interfaces.
Signatures:
A signature is a set of rules that an IDS and an IPS use to detect typical intrusive activity, such
as DoS attacks. We can easily install signatures using IDS and IPS management software such
as Cisco IDM. Sensors enables us to modify existing signatures and define new ones.
As sensors scan network packets, they use signatures to detect known attacks and respond
with predefined actions. A malicious packet flow has a specific type of activity and signature,
and an IDS or IPS sensor examines the data flow using many different signatures. When an IDS
or IPS sensor matches a signature with a data flow, the sensor takes action, such as logging the
event or sending an alarm to IDS or IPS management software, such as the Cisco SDM
ISMAIL H P Page 1
SIC JOURNAL TYIT
We define some of the commands which will be used while configuring the Router for IPS
Commands Function Example
ip ips signature- Enters IPS category Router(config)# ip ips signature-category
category configuration mode.
category Specifies that all categories Router(config-ips-category)# category all
(and all signatures) are
retired in the following step
and enters IPS category
action configuration mode
Example:
Router(config-ips-category)# category
ios_ips basic
Specifies the basic category
(and a set of signatures) that
are to be “unretired” in the
following step.
retired {true | false} Specifies that the device Router(config-ips-category-action)#
should retire all categories retired true
(and all signatures).
true --Retires all signatures
within a given category.
false --“Unretires” all
signatures within a given
category.
mkdir flash:/ips5 Create a directory for which Example:
Cisco IOS IPS saves Device# mkdir flash:/ips5
signature information.
ip ips name ips- Example:
name Device(config)# ip ips name myips
ip ips ips- Applies an IPS rule at an Example:
name {in | out} interface and automatically Device(config-if)# ip ips MYIPS in
loads the signatures and
builds the signature engines.
ISMAIL H P Page 2
SIC JOURNAL TYIT
We us the following topology for the present case
Configuring PC0
ISMAIL H P Page 3
SIC JOURNAL TYIT
Configuring PC1
Configuring SERVER0
ISMAIL H P Page 4
SIC JOURNAL TYIT
Serial Interface must be added in each Router before configuring it
Configuring Router0
ISMAIL H P Page 5
SIC JOURNAL TYIT
Configuring Router1
ISMAIL H P Page 6
SIC JOURNAL TYIT
Configuring Router2
ISMAIL H P Page 7
SIC JOURNAL TYIT
We need to set the Routing table in all the Routers so that each node could send
and receive packets from others (RIP is set in all the Routers as follows)
Router0
Router1
ISMAIL H P Page 8
SIC JOURNAL TYIT
Router2
Now we can check the connectivity by sending ping commands from any node to any
other node
So we conclude that the connectivity has been established
ISMAIL H P Page 9
SIC JOURNAL TYIT
PART1: Enable the IOS IPS (on Router1)
Type the following command in the CLI mode of Router1
Router#show version
We will get a message informing whether the security Package is enabled or not
As seen above the security package is not enabled, to enable the security feature,
type the following command in Router1
Router(config)#license boot module c1900 technology-package securityk9
Router(config)#exit
Router#
Router#reload
Router>enable
Router#
Router#show version
We will get a message informing whether the security package is enabled or not
ISMAIL H P Page 10
SIC JOURNAL TYIT
As seen above now the security package has been enabled
Now type the following commands in the CLI mode of Router1
Router#
Router#
Router#clock set 11:47:56 MARCH 3 2020
Router#mkdir smile
Router#configure terminal
Router(config)#ip ips config location flash:smile
Router(config)#ip ips name iosips
Router(config)#ip ips notify log
Router(config)#ip ips signature-category
Router(config-ips-category)#category all
Router(config-ips-category-action)#retired true
Router(config-ips-category-action)#exit
Router(config-ips-category)#category ios_ips basic
Router(config-ips-category-action)#retired false
Router(config-ips-category-action)#exit
Router(config-ips-category)#exit
Router(config)#interface Serial0/1/0
Router(config-if)#ip ips iosips out
Router(config-if)#
Router(config)#
ISMAIL H P Page 11
SIC JOURNAL TYIT
Part 2: Modify the Signature
Type the following commands in the CLI mode of Router1
Router(config)#
Router(config)#ip ips signature-definition
Router(config-sigdef)#signature 2004 0
Router(config-sigdef-sig)#status
Router(config-sigdef-sig-status)#retired false
Router(config-sigdef-sig-status)#enabled true
Router(config-sigdef-sig-status)#exit
Router(config-sigdef-sig)#engine
Router(config-sigdef-sig-engine)#event-action produce-alert
Router(config-sigdef-sig-engine)#event-action deny-packet-inline
Router(config-sigdef-sig-engine)#exit
Router(config-sigdef-sig)#exit
Router(config-sigdef)#exit
Router(config)#
Now we need to verify the above IPS configuration, we do it first by pinging PC1
to SERVER and then from SERVER to PC1
PC1 to SERVER
The ping FAILS
ISMAIL H P Page 12
SIC JOURNAL TYIT
SERVER to PC1
Also we can observe the Syslog service in the SERVER to check the log activities
Hence we set the IPS and also verified it on Router1
ISMAIL H P Page 13
