The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Cisco IOS IPS Support for Microsoft Engines feature extends Cisco IOS Intrusion Prevention Systems (IPS) to support Microsoft RPC (Remote Procedure Call) and Microsoft SMB (Server Message Block) protocols. IPS signatures can now scan for, detect, and take proper action against vulnerabilities in MSRPC and SMB protocols.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Cisco IOS IPS Support for Microsoft Engines" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
•Information About Cisco IOS IPS Support for Microsoft Engines
•Configuration Examples for Cisco IOS IPS
•Feature Information for Cisco IOS IPS Support for Microsoft Engines
Before using IPS, you should understand the following concept:
The Cisco IOS IPS acts as an in-line intrusion prevention sensor, watching packets and sessions as they flow through the router and scanning each packet to match any of the Cisco IOS IPS signatures. When it detects suspicious activity, it responds before network security can be compromised and logs the event through Cisco IOS syslog messages or Security Device Event Exchange (SDEE). The network administrator can configure Cisco IOS IPS to choose the appropriate response to various threats. The Signature Event Action Processor (SEAP) can dynamically control actions that are to be taken by a signature event on the basis of parameters such as fidelity, severity, or target value rating. These parameters have default values but can also be configured via CLI. When packets in a session match a signature, Cisco IOS IPS can take any of the following actions, as appropriate:
•Send an alarm to a syslog server or a centralized management interface
•Drop the packet
•Reset the connection
•Deny traffic from the source IP address of the attacker for a specified amount of time
•Deny traffic on the connection for which the signature was seen for a specified amount of time
Cisco developed its Cisco IOS software-based intrusion-prevention capabilities and Cisco IOS Firewall with flexibility in mind, so that individual signatures could be disabled in case of false positives. Generally, it is preferable to enable both the firewall and Cisco IOS IPS to support network security policies. However, each of these features may be enabled independently and on different router interfaces.
The addition of the MSRPC and MSB protocol support does not change the way in which Cisco IOS IPS is defined and enabled in your network. For information on how to enable IPS on your network via command-line interface (CLI), see the section "How to Use Cisco IOS 5.x Format Signatures with Cisco IOS IPS" within the document Cisco IOS IPS 5.x Signature Format Support and Usability Enhancements.
This section contains the following example:
•show ip ips signature Output to Verify MS Engines: Example
The following sample output from the show ip ips signature command displays output for the service-msrpc and service-smb-advanced signatures:
Signature Micro-Engine: service-msrpc: Total Signatures 21 service-msrpc enabled signatures: 21 service-msrpc compiled signatures: 21 SigID:SubID En Cmp Action Sev Trait EC AI GST SI SM SW SFR Rel ----------- -- ---- ------ --- ----- ---- ---- ----- --- -- -- --- --- 3330:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S148 3332:0 Y Y A HIGH 0 35 0 0 0 FA N 100 S148 3337:0 Y Y A HIGH 0 8 2 0 0 FA N 100 S85 3331:2 Y Y A HIGH 0 1 0 0 0 FA N 90 S215 3327:12 Y Y A HIGH 0 1 0 0 0 FA N 85 S214 3328:3 Y Y A MED 0 1 0 0 0 FA N 85 S170 3328:1 Y Y A MED 0 1 0 0 0 FA N 85 S148 3327:8 Y Y A INFO 0 1 0 0 0 FA N 85 S214 3334:6 Y Y A HIGH 0 1 0 0 0 FA N 80 S215 3327:0 Y Y A HIGH 0 1 0 0 0 FA N 80 S165 6232:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S209 3327:4 Y Y A HIGH 0 1 0 0 0 FA N 75 S188 3334:5 Y Y A HIGH 0 2 2 0 0 FA N 75 S179 3338:2 Y Y A HIGH 0 40 3 0 0 FA N 75 S175 3338:3 Y Y A HIGH 0 1 0 0 0 FA N 75 S175 6130:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S167 6130:6 Y Y A INFO 0 1 0 0 0 FA N 75 S192 5567:1 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:2 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:3 Y Y A INFO 0 1 0 0 0 FA N 55 S187 5567:4 Y Y A INFO 0 1 0 0 0 FA N 55 S187
Signature Micro-Engine: service-smb-advanced: Total Signatures 31 service-smb-advanced enabled signatures: 31 service-smb-advanced compiled signatures: 31 SigID:SubID En Cmp Action Sev Trait EC AI GST SI SM SW SFR Rel ----------- -- ---- ------ --- ----- ---- ---- ----- --- -- -- --- --- 5593:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5592:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5582:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5599:0 Y Y A HIGH 0 1 0 0 0 FA N 100 S262 5595:0 Y Y A MED 0 1 0 0 0 FA N 100 S262 5579:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5581:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5580:0 Y Y A INFO 0 1 0 0 0 FA N 100 S264 5584:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5576:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5577:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5583:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5591:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5590:0 Y Y A INFO 0 1 0 0 0 FA N 100 S262 5598:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S264 5588:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S262 5586:0 Y Y A HIGH 0 1 0 0 0 FA N 85 S262 5585:0 Y Y A MED 0 1 0 0 0 FA N 85 S264 5579:1 Y Y A MED 0 1 0 0 0 FA N 85 S264 5602:0 Y Y A MED 0 1 0 0 0 FA N 85 S262 5589:0 Y Y A LOW 0 1 0 0 0 FA N 85 S262 5578:0 Y Y A INFO 0 1 0 0 0 FA N 85 S264 5605:0 Y Y A INFO 0 1 0 0 0 FA N 85 S262 5600:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5597:0 Y Y A HIGH 0 50 0 0 0 FA N 75 S262 5594:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5587:0 Y Y A HIGH 0 1 0 0 0 FA N 75 S262 5603:0 Y Y A MED 0 1 0 0 0 FA N 75 S262 5591:1 Y Y A INFO 0 1 0 0 0 FA N 75 S262 5575:0 Y Y A INFO 0 1 0 0 0 FA N 75 S262 5590:1 Y Y A INFO 0 1 0 0 0 FA N 75 S262
|
|
---|---|
Cisco IOS commands |
|
Security commands |
|
Cisco IOS IPS configuration tasks and commands |
Cisco IOS IPS 5.x Signature Format Support and Usability Enhancements |
|
|
---|---|
None |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.