Cisco IOS Intrusion Prevention System (IPS)

Cisco IOS IPS Data Sheet

  • Viewing Options

  • PDF (391.7 KB)
  • Feedback

This data sheet provides an overview of the Cisco IOS® Intrusion Prevention System (IPS) solution.

Product Overview

In today’s business environment, network intruders and attackers can come from outside or inside the network. They can launch distributed denial-of-service attacks, they can attack Internet connections, and they can exploit network and host vulnerabilities. At the same time, Internet worms and viruses can spread across the world in a matter of minutes. There is often no time to wait for human intervention—the network itself must possess the intelligence to recognize and mitigate these attacks, threats, exploits, worms and viruses.

Cisco IOS Intrusion Prevention System (IPS) is an inline, deep-packet inspection-based solution that enables Cisco IOS Software to effectively mitigate a wide range of network attacks. While it is common practice to defend against attacks by inspecting traffic at data centers and corporate headquarters, distributing the network level defense to stop malicious traffic close to its entry point at branch or telecommuter offices is also critical.

Cisco IOS IPS: Major Use Cases and Key Benefits

IOS IPS helps to protect your network in 5 ways:


Key Benefits

   Provides network-wide, distributed protection from many attacks, exploits, worms and viruses exploiting vulnerabilities in operating systems and applications

   Eliminates the need for a standalone IPS device at branch and telecommuter offices as well as small and medium-sized business networks

   Unique, risk rating based signature event action processor dramatically improves the ease of management of IPS policies

   Offers field-customizable worm and attack signature set and event actions

   Offers inline inspection of traffic passing through any combination of router LAN and WAN interfaces in both directions

   Works with Cisco IOS® Firewall, control-plane policing, and other Cisco IOS Software security features to protect the router and networks behind the router

   Supports more than 3700 signatures from the same signature database available for Cisco Intrusion Prevention System (IPS) appliances

Table 1.       Cisco IOS IPS in the Latest IOS Releases Offers the Following Capabilities



Capability to download IOS IPS signature packages to the router directly from CCO - Available in 15.1(1)T or later IOS T-Train Releases

Easier  to use and deploy the feature, eliminating the need (step) to manually download signature updates to a local server first and then to the router

Routers that have connection to the Internet can download signature updates automatically in a periodic fashion without human intervention

New Default IOS IPS Category signatures (including some lightweight signatures) is updated frequently by Cisco Signature Team starting with IOS 15.0(1)M Release

More comprehensive and effective attack coverage by default.

Much quicker inclusion of most relevant new threat signatures within the default set (category).

Lightweight Signature Engines for HTTP, SMTP and FTP protocol signatures and Regular Expression Table chaining available also in 15.0(1)M Release

Memory efficient traffic scanning for attack signatures consuming less memory on the router.

Capability to provide protection for larger number of common threats and vulnerabilities.

VRF Awareness (Virtual IPS) - Available in 12.4(20)T or later IOS T-Train Releases

Allows enterprises to apply IPS on only certain virtual network segments (VRFs) and/or with different inspection rules on each VRF, and distinguish among the IPS alarms/events generated within each virtual segment via VRF ID.

Available in 12.4(15)T5 or later IOS T-Train Releases

Supports Signatures for Vulnerabilities in Microsoft SMB and MSRPC Protocols as well as Signatures Provided by Vendors under NDA

Efficient protection against many new Microsoft and other vulnerabilities, some even before their public release

Risk Rating Value in IPS Alarms Based on Signature Severity, Fidelity, and Target Value Rating

Allows more accurate and efficient IPS event monitoring by filtering or separating events with low/high Risk Rating

Supports Signature Event Action Processor (SEAP)

Quick and automated adjustment of signature event actions based on calculated Risk Rating of the event

Automated Signature Updates from a Local TFTP or HTTP(S) Server

Protection from latest threats with minimal user intervention

IDCONF (XML) Signature Provisioning Mechanism

Offers secure provisioning through Cisco Security Manager 3.1 and Cisco Router and Security Device Manager (SDM) 2.4 over HTTPS

Individual and Category-Based Signature Provisioning through Cisco IOS CLI

Offers granular customization and tuning of signatures through custom scripts

Same Signature Format and Database as the Latest Cisco® IPS Appliances and Modules

Offers common deployment and attack signature definitions between Cisco IPS appliances/modules and Cisco IOS® IPS

Platform Support

Cisco IOS IPS is available in certain software feature sets on the 87x routers, Integrated Services Routers, SR520, 720x and 7301 routers listed in Table 2. Starting with IOS 15.0(1)M Release, IOS IPS feature is also supported on the 88x, 89x routers and next generation Integrated Services Routers with an optional license that enables use of that and other features when installed, as shown in Table 3. 

Table 2.       IPS Feature Availability based on IOS Image Types

Product Family

Platforms Supported

IOS Images (Feature Sets) Supported


871, 876, 877, 878

Advanced IP Services


1801,1802,1803,1811,1812,1841, 1861

Advanced Security, Advanced Enterprise, and Advanced IP Services


2801, 2811,2821,2851

Advanced Security, Advanced Enterprise, and Advanced IP Services



Advanced Security, Advanced Enterprise, and Advanced IP Services



Advanced Security and Advanced IP Services


7204VXR, 7206VXR

Advanced Security, Advanced Enterprise, and Advanced IP Services



Advanced Security, Advanced Enterprise, and Advanced IP Services

Table 3.       IPS Feature Availability based on Optional Feature Licenses   

Product Family

Platforms Supported

Feature License Supported


881, 886, 887, 888, 891, 892

Advanced IP Services


1921, 1941



2901, 2911,2921,2951





Basic, Advanced and Default Signature Categories for IOS IPS

In Cisco IOS Software Release 12.4(11)T and later T-Train releases, IOS IPS signature provisioning is accomplished by selecting one of two signature categories: Basic or Advanced. Starting with IOS 15.0(1)M Release, a new category called “IOS IPS Default” will be also supported and released within IPS signature packages. At that time, IOS Advanced category will be changed to contain exactly the same signatures as in the IOS Default category, allowing both category names to be used interchangeably for backward compatibility. Users may also add or remove individual signatures and/or can tune signature parameters via Cisco Configuration Professional (CCP) or Cisco Security Manager (CSM) management or through the command-line interface (CLI) which allows easy scripting to manage signature configuration for a large number of routers.

IOS Basic and Advanced/Default signature categories are pre-selected signature sets intended to serve as a good starting set for most users of IOS IPS. They contain the latest high-fidelity (low false positives) worm, virus, IM, or peer-to-peer blocking signatures for detecting security threats, allowing easier deployment and signature management. Cisco IOS IPS also allows selection and tuning of signatures outside those two categories.

Signature categories are an integral part of Cisco signature update packages posted at

Users can also access to this link from Cisco Software Download page by clicking on "Security" followed by "Integrated Router/Switch Security" link followed by "Integrated Threat Control" link and finally clicking on "Cisco IOS Intrusion Prevention System Feature Software" link.

Those signature update packages are cumulative of all previous Cisco IPS signature updates and can be downloaded to the router from a local PC or server using the router CLI, Cisco Configuration Professional (CCP) or Cisco Security Manager (CSM).

Use of Cisco IOS IPS in IOS Mainline and T-Train releases prior to 12.4(11)T is not recommended. No signature updates are provided in the signature format used by IOS IPS Feature in those releases. Also, support for IOS IPS feature in those older releases is very limited.

Cisco Services for IPS

Entitlement to download and use signature update packages for Cisco IOS IPS feature requires purchase of the appropriate Cisco Services for IPS contract which includes Cisco SMARTnet support deliverables in a single comprehensive service offering. Supported by the Cisco Global Security Intelligence organization, Cisco Services for IPS delivers continuously updated, comprehensive, and accurate detection technology to identify and block fast-moving and emerging threats before they damage your network assets.

Starting with IOS 15.0(1)M1 Release, a valid IOS IPS Signature Subscription license is required to be installed on 88x, 89x, 19xx, 29xx and 39xx routers to be able to load signature packages released after a certain date (to be announced) . To obtain and install this license, the customer needs to purchase the Cisco Services for IPS contract SKU relevant to the router model as well as the type and level of the associated SMARTnet deliverables desired.

For more information about Cisco Services for IPS, visit

Signature Micro Engines

Cisco IOS IPS uses Signature Micro-Engines (SMEs) to load (into the router’s memory) and scan for a set of attack signatures. Each engine is customized for inspecting a Layer 4 or 7 protocol and its fields/arguments. Within each packet carrying data for that protocol, it looks for a set of legal parameters that have allowable ranges or sets of values. It also scans for malicious activity specific to that protocol using a parallel signature scanning technique to scan for multiple patterns within an SME at any given time.

Attack Mitigation

Cisco IOS IPS can protect your network more than 3700 attacks, exploits, worms and viruses. Some examples of attacks that can be detected and stopped by Cisco IOS IPS include many Microsoft Windows OS and application vulnerability exploits, viruses and worms.

Actions for Detected Signatures

Each individual signature or category of signatures selected to scan traffic for matching attacks can be configured to take any combination of the following 5 actions when triggered:

1.     Send an alarm via syslog message or log an alarm in SDEE (Secure Device Event Exchange) format

2.     Drop malicious packet

3.     Send TCP-Reset packets to both ends of the connection to terminate the session

4.     Deny all packets from the attacker (source address) temporarily

5.     Deny further packets belonging to the same TCP session (connection) from the attacker (source address).

Configuration and Signature Provisioning

The router CLI or Cisco Configuration Professional (CCP) version 1.1 or later can be used for configuration of IOS IPS as well as highly granular provisioning and tuning of IPS signatures on a single router running Cisco IOS 12.4(11)T2 or later releases. In addition, Cisco Security Manager (CSM) version 3.2 or later may be used for management of IPS policies and signature sets on multiple routers running Cisco IOS 12.4(11)T2 or later releases. Use of IOS IPS in IOS releases prior to 12.4(11)T or IOS Mainline releases is NOT recommended.

Event Monitoring

Upon detecting an attack signature, Cisco IOS IPS can send a syslog message or log an alarm in Secure Device Event Exchange (SDEE) format. CCP may be used to monitor events generated by a single router and Cisco IPS Manager Express (IME) may be used to monitor IPS events generated by up to 5 routers. For monitoring events from more than 5 routers, Cisco highly recommends the Cisco Security Monitoring, Analysis, and Response System (MARS) appliance for network wide monitoring and correlation of IPS alarms, although any compatible monitoring application or device supporting syslog and/or SDEE may be used.

For More Information

For more information about Cisco IOS IPS, visit or contact your local Cisco account representative.