Security Configuration Guide: Cisco IOS Intrusion Prevention System Cisco IOS Release 15.1M&T
Cisco Services for IPS on IOS
Downloads: This chapterpdf (PDF - 150.0KB) | Feedback

Cisco Services for IPS on IOS

Table Of Contents

Cisco Services for IPS on IOS

Finding Feature Information

Contents

Prerequisites for Cisco Services for IPS on IOS

Restrictions for Cisco Services for IPS on IOS

Information About Cisco Services for IPS on IOS

Cisco Services for IPS Service Contract

Cisco IOS IPS Subscription License Details

Cisco IOS IPS Signature Package

IPS Subscription License Verification

Cisco IOS Licensing Installation, Administration and Management

How to Work with Cisco Services for IPS on IOS

Displaying the Status of an IPS License

SUMMARY STEPS

Configuration Examples for Cisco Services for IPS on IOS

Displaying Valid License Details: Example

Displaying the Details of an Expired License: Example

Displaying the Details for an Uninstalled License: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Cisco Services for IPS on IOS


Cisco Services for IPS on IOS


First Published: October 2, 2009
Last Updated: March 28, 2011

Note Effective with Cisco IOS Release 15.1(4)M, this feature is not available in Cisco IOS software.


The Cisco Services for IPS on IOS feature enforces the presence of a valid Intrusion Prevention System (IPS) subscription license before loading signatures released beyond a certain date when the IOS IPS is enabled. A Cisco Services for IPS contract must be purchased or renewed in order to be able to load new signatures; otherwise, the feature will not detect or stop the new attacks making the feature useless.

This feature adds license checking to the signature packages that are distributed by Cisco Systems, Inc. and loaded on IOS Integrated Services Routers (ISR). IOS IPS is enabled on ISRs to detect and act on signatures. Signature packages are created by the signature team and distributed on www.cisco.com. As the signature package is loaded on the ISR, a check is performed to see if there is a valid subscription license for loading IPS signatures. The date of the signature releases contained in the package are checked against the expiration date of the subscription license. Any signatures that are released before the expiration date are loaded and those released after the expiration date are not loaded.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Cisco Services for IPS on IOS" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

Prerequisites for Cisco Services for IPS on IOS

Restrictions for Cisco Services for IPS on IOS

Information About Cisco Services for IPS on IOS

How to Work with Cisco Services for IPS on IOS

Configuration Examples for Cisco Services for IPS on IOS

Additional References

Feature Information for Cisco Services for IPS on IOS

Prerequisites for Cisco Services for IPS on IOS

A user must purchase a Cisco Services for IPS service contract, using the proper contract Stock Keeping Unit (SKU) like CON-SU1-C2811-SEC, for the specific router.

An IPS signature subscription license file is required to be loaded to enable loading of new signatures on that particular router. After purchasing an SKU, an IPS-related license file can be downloaded from www.cisco.com/go/license via the "Licenses not requiring a PAK" link.

The router needs to be configured to run the IOS IPS feature, although a contract purchase or a license is not needed to configure and run IOS IPS on any router.

Restrictions for Cisco Services for IPS on IOS

Except for service providers and partners who buy a "Shared Support" contract, Cisco Services for IPS on IOS is always tied into a smartNet (Hardware and Software) support contract.

A subscription license will not work on 87x, 720x and 7301 routers, regardless of contract purchase.

Information About Cisco Services for IPS on IOS

Before using Cisco Services for IPS on IOS, you should understand the following concepts:

Cisco Services for IPS Service Contract

Cisco IOS IPS Subscription License Details

Cisco IOS IPS Signature Package

IPS Subscription License Verification

Cisco IOS Licensing Installation, Administration and Management

Cisco Services for IPS Service Contract

Cisco Services for IPS is a service contract that includes smartNet services along with an IPS signature update subscription, that allows generation of an IPS subscription license file that is unique for the router the service contract has been sold for.

For further information on Cisco Services for IPS, see the Cisco Services for IPS document.

Cisco IOS IPS Subscription License Details

A Cisco IOS IPS Subscription License is a license to enable a router to load signatures released after a certain date. It is not a license to either turn on the IPS feature or to download IPS signature packages from CCO.

Cisco CA will require a Cisco Services for IPS contract purchase to generate a license file based on the router Product ID (PID) and Serial Number (SN). A 60-day trial license can be generated once for each PID and SN combination (also called UDI - Universal Device Identifier).

Cisco IOS IPS Signature Package

A Cisco IOS IPS Signature Package is a data file that is used to configure an IOS IPS feature on the router with signatures to scan traffic. The file is packaged using scripts maintained by the Cisco signature team. The IOS IPS signature data file is posted to CCO for download at:

http://tools.cisco.com/support/downloads/go/Model.x?mdfid=281442967&mdfLevel=Software%20Family&treeName=Security&modelName=Cisco%20IOS%20Intrusion%20Prevention%20System%20Feature%20Software&treeMdfId=268438162

The signature file may be downloaded and loaded on the router(s). There is no license required to download the signature package from CCO or copy it to a router but a valid ios_ips_update license file is required to load (compile) signatures released after a certain date into the router's tables used to scan traffic.

IPS Subscription License Verification

Cisco IOS Software Licensing (CSL) provides a framework for verifying licenses on a router running Cisco IOS software. IOS IPS needs to query CSL to determine if the license file is valid and that the router has permission to load the latest signature update.

If the license is valid, the new signatures may be loaded. If the license is not valid or unavailable, the signature will not be loaded. If the license is expired, only those signature updates that were produced before the license expiration date may be loaded.

Cisco IOS Licensing Installation, Administration and Management

For information on IOS licensing installation, administration, and management, refer to the "Related Documents" section.

How to Work with Cisco Services for IPS on IOS

This section contains the following task:

Displaying the Status of an IPS License

Displaying the Status of an IPS License

Perform this task to display the status of a license. The show ip ips license command displays IPS license information. This information includes the license expiration date and the version date of the existing loaded signatures, as well as the highest version date of last signature package loaded. If the license is still valid, the existing loaded signature version will be the same as the last signature package.

SUMMARY STEPS

1. enable

2. show ip ips {all | configuration | interfaces | license | name name | sessions [detail] [vrf vrf-name] | signatures [detail] | statistics [reset] [vrf vrf-name]}

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 

show ip ips {all | configuration | interfaces | license | name name | sessions [detail] [vrf vrf-name] | signatures [detail] | statistics [reset] [vrf vrf-name]}

Example:

Router# show ip ips license

Displays license details including the license expiration date, the version date of the loaded signatures, and the highest version date of the last signature package loaded.

Configuration Examples for Cisco Services for IPS on IOS

This section provides the following examples:

Displaying Valid License Details: Example

Displaying the Details of an Expired License: Example

Displaying the Details for an Uninstalled License: Example

Displaying Valid License Details: Example

The following task displays the details of a valid license:

Router# show ip ips license

IPS License Status Valid
Expiration Date: 2009-12-31
Signatures Loaded: 2009-06-25 S375
Signature Package: 2009-06-25 S375

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-06-25 S375), and the version date of the last signature package loaded (2009-06-25 S375). The license is valid as the existing loaded signature version date is the same as the last signature package version date. The last signature package date (2009-06-25) is also before the license expiration date (2009-12-31).

Displaying the Details of an Expired License: Example

The following example displays the details of an expired license:

Router# show ip ips license

IPS License Status Expired
Expiration Date: 2009-12-31
Signatures Loaded: 2009-12-25 S393
Signature Package: 2010-03-10 S402

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-12-25 S393), and the version date of the last signature package loaded (2010-03-10 S402). The license has expired as the existing loaded signature version date is not the same as the last signature package version date. The last signature package date (2010-03-10) is also after the expiration date (2009-12-31).

Displaying the Details for an Uninstalled License: Example

The following example displays the details of an uninstalled license:

Router# show ip ips license

IPS License Status Not installed

Additional References

Related Documents

Related Topic
Document Title

IOS License Installation

"Installing and Upgrading Licenses by Using Software Activation Commands" section in the Cisco IOS Software Activation Feature, Release 12.4(20)T

IOS License Administration and Management

Cisco IOS Software Activation Overview

Software Activation on Cisco Integrated Routers

Software Activation on Cisco Integrated Routers

Cisco License Manager application

Cisco License Manager

Configuring IOS IPS and loading a Signature File

IPS 5.x Signature Format Support and Usability Enhancements


Standards

Standard
Title

None


MIBs

MIB
MIBs Link

CISCO-LICENSE-MGMT-MIB

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

None


Technical Assistance

Description
Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html


Feature Information for Cisco Services for IPS on IOS

Table 1 lists the release history for this feature.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.


Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.


Table 1 Feature Information for Cisco Services for IPS on IOS 

Feature Name
Releases
Feature Information

Cisco Services for IPS on IOS

15.0(1)M

The Cisco Services for IPS on IOS feature enforces the presence of a valid IPS subscription license when signatures are loaded on a router where the IOS IPS feature is turned on.

The following commands were introduced or modified: show ip ips.

Disabling of IOS IPS Licensing

15.1(4)M

Effective with Cisco IOS Release 15.1(4)M, the Cisco Services for IPS on IOS feature is not available in Cisco IOS software. The show ip ips command license keyword is deprecated.