 Feedback
|
Table Of Contents
Cisco IOS IPS Support for Microsoft Engines
Information About Cisco IOS IPS Support for Microsoft Engines
Configuration Examples for Cisco IOS IPS
show ip ips signature Output to Verify MS Engines:Example
Feature Information for Cisco IOS IPS Support for Microsoft Engines
Cisco IOS IPS Support for Microsoft Engines
First Published: June 28, 2007Last Updated: June 28, 2007The Cisco IOS IPS Support for Microsoft Engines feature extends Cisco IOS Intrusion Prevention Systems (IPS) to support Microsoft RPC (Remote Procedure Call) and Microsoft SMB (Server Message Block) protocols. IPS signatures can now scan for, detect, and take proper action against vulnerabilities in MSRPC and SMB protocols.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for Cisco IOS IPS Support for Microsoft Engines" section.
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Information About Cisco IOS IPS Support for Microsoft Engines
•
•
Information About Cisco IOS IPS Support for Microsoft Engines
Before using IPS, you should understand the following concept:
Cisco IOS IPS Overview
The Cisco IOS IPS acts as an in-line intrusion prevention sensor, watching packets and sessions as they flow through the router and scanning each packet to match any of the Cisco IOS IPS signatures. When it detects suspicious activity, it responds before network security can be compromised and logs the event through Cisco IOS syslog messages or Security Device Event Exchange (SDEE). The network administrator can configure Cisco IOS IPS to choose the appropriate response to various threats. The Signature Event Action Processor (SEAP) can dynamically control actions that are to be taken by a signature event on the basis of parameters such as fidelity, severity, or target value rating. These parameters have default values but can also be configured via CLI. When packets in a session match a signature, Cisco IOS IPS can take any of the following actions, as appropriate:
•
•
•
•
•
Cisco developed its Cisco IOS software-based intrusion-prevention capabilities and Cisco IOS Firewall with flexibility in mind, so that individual signatures could be disabled in case of false positives. Generally, it is preferable to enable both the firewall and Cisco IOS IPS to support network security policies. However, each of these features may be enabled independently and on different router interfaces.
How to Use Cisco IOS IPS
The addition of the MSRPC and MSB protocol support does not change the way in which Cisco IOS IPS is defined and enabled in your network. For information on how to enable IPS on your network via command-line interface (CLI), see the section "How to Use Cisco IOS 5.x Format Signatures with Cisco IOS IPS" within the document Cisco IOS IPS 5.x Signature Format Support and Usability Enhancements.
Configuration Examples for Cisco IOS IPS
This section contains the following example:
•
show ip ips signature Output to Verify MS Engines:Example
The following sample output from the show ip ips signature command displays output for the service-msrpc and service-smb-advanced signatures:
Signature Micro-Engine: service-msrpc: Total Signatures 21 service-msrpc enabled signatures: 21 service-msrpc compiled signatures: 21 SigID:SubID En Cmp Action Sev Trait EC AI GST SI SM SW SFR Rel ----------- -- ---- ------ --- ----- ---- ---- ----- --- -- -- --- --- 3330:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S148 3332:0 Y Y A HIGH 0 35 0 0 0 FA N 100 S148 3337:0 Y Y A HIGH 0 8 2 0 0 FA N 100 S85 3331:2 Y Y A HIGH 0 1 0 0 0 FA N 90 S215 3327:12 Y Y A HIGH 0 1 0 0 0 FA N 85 S214 3328:3 Y Y A MED 0 1 0 0 0 FA N 85 S170 3328:1 Y Y A MED 0 1 0 0 0 FA N 85 S148 3327:8 Y Y A INFO 0 1 0 0 0 FA N 85 S214 3334:6 Y Y A HIGH 0 1 0 0 0 FA N 80 S215 3327:0 Y Y A HIGH 0 1 0 0 0 FA N 80 S165 6232:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S209 3327:4 Y Y A HIGH 0 1 0 0 0 FA N 75 S188 3334:5 Y Y A HIGH 0 2 2 0 0 FA N 75 S179 3338:2 Y Y A HIGH 0 40 3 0 0 FA N 75 S175 3338:3 Y Y A HIGH 0 1 0 0 0 FA N 75 S175 6130:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S167 6130:6 Y Y A INFO 0 1 0 0 0 FA N 75 S192 5567:1 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:2 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:3 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:4 Y Y A INFO 0 1 0 0 0 FA N 55 S187Signature Micro-Engine: service-smb-advanced: Total Signatures 31 service-smb-advanced enabled signatures: 31 service-smb-advanced compiled signatures: 31 SigID:SubID En Cmp Action Sev Trait EC AI GST SI SM SW SFR Rel ----------- -- ---- ------ --- ----- ---- ---- ----- --- -- -- --- --- 5593:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5592:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5582:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5599:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5595:0 Y Y A MED 0 1 0 0 0 FA N 100 S262 5579:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5581:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5580:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5584:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5576:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5577:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5583:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5591:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5590:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5598:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S264 5588:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S262 5586:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S262 5585:0 Y Y A MED 0 1 0 0 0 FA N 85 S264 5579:1 Y Y A MED 0 1 0 0 0 FA N 85 S264 5602:0 Y Y A MED 0 1 0 0 0 FA N 85 S262 5589:0 Y Y A LOW 0 1 0 0 0 FA N 85 S262 5578:0 Y Y A INFO 0 1 0 0 0 FA N 85 S264 5605:0 Y Y A INFO 0 1 0 0 0 FA N 85 S262 5600:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5597:0 Y Y A HIGH 0 50 0 0 0 FA N 75 S262 5594:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5587:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5603:0 Y Y A MED 0 1 0 0 0 FA N 75 S262 5591:1 Y Y A INFO 0 1 0 0 0 FA N 75 S262 5575:0 Y Y A INFO 0 1 0 0 0 FA N 75 S262 5590:1 Y Y A INFO 0 1 0 0 0 FA N 75 S262Additional References
The following sections provide references related to the Cisco IOS IPS Support for Microsoft Engines feature.
Related Documents
Cisco IOS IPS configuration tasks and commands
Cisco IOS IPS 5.x Signature Format Support and Usability Enhancements, Cisco IOS Release 12.4(11)T feature module
Standards
MIBs
None
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents only commands modified.
debug ip ips
To enable debugging messages for Cisco IOS Intrusion Prevention System (IPS), use the debug ip ips command in privileged EXEC mode. To disable debugging messages, use the no form of this command.
debug ip ips [engine] [detailed] [service-msrpc] [service-sm]
no debug ip ips [engine] [detailed]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.3(8)T
This command was introduced.
12.4(15)T
The service-msrpc and the service-sm keywords were added to support Microsoft communication protocols MSRPC and SMB.
Examples
The following example shows how to enable debugging messages for the Cisco IOS IPS:
Router# debug ip ipsFeature Information for Cisco IOS IPS Support for Microsoft Engines
Table 1 lists the release history for this feature.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.
