Chapter 16 - Implementing IOS based IPS Flashcards
What detection technology is available in an IPS appliance that is not on IOS based IPS?
anomaly-based detection.
IOS based IPS uses the following detection techologies:
- Profile based
- Signature based
- Protocol analysis based
Where should inspection take place on a router running IOS based IPS?
Inspection should happen inbound on the interface (or interfaces) connected to untrusted networks (Internet), or less-trusted networks.
What is the difference between a Retired and Unretired signature?
Unretired: The signtaure is compiled on the router and consumes memory even if it is enabled OR disabled.
Retired: There is no memory consumption on the router because the signature is not compiled (it can not be enabled).
SDEE is required for IPS to function on a router. How do you enable it via the CLI?
(config)# ip ips notify SDEE
What is SDEE?
SDEE is Security Device Event Exchange.
It is the protocol used to deliver alert information.
How do you create an IPS rule via the command line?
(config)# ip ips name <ips_rule_name></ips_rule_name>
To apply it to an interface:
(config-if)# ip ips <ips_rule_name> in</ips_rule_name>
In = inbound
How can you view how IPS is configured via command line?
show ip ips configuration
What is a disabled signature doing on a IPS device?
A signature that is “Disabled” means that the signature does not produce an alert but is compiled into memory and inspection takes place. It continues to consume router resources and can be quickly enabled.
What are the basic tasks that must be completed using Cisco Configuration Professional (CCP) to setup IPS on a router?
- Specify the signature file and the Cisco public key
- Specify the configuration location and select the category of signatures to be applied to the selected interface(s).
- Select the interface(s) to apply the IPS rule
- Select the traffic flow direction that should be applied by the IPS rule
What is the realm-cisco.pub public encryption key used for?
It is used to verify the digital signature of Cisco IPS signature file(s).
