セキュリティ : Cisco 侵入防御システム

シスコ IPS 自動シグニチャアップデート 機能がどのように動作するかについて

2012 年 10 月 25 日 - 機械翻訳について
その他のバージョン: PDFpdf | 英語版 (2012 年 8 月 17 日) | フィードバック


????

?T?v
?O??????
      ?v??
      ?g?p?????R???|?[?l???g
      ?\?L?@
?l?b?g???[?N?v??
?V?O?j?`???????A?b?v?f?[?g?v???Z?X
????
????????
?g???u???V???[?e?B???O
?????@?\?g??
Cisco サポート コミュニティ - 特集対話
???A????

?T?v

???????????V?X?R ?N???h?? ?V?X?e???iIPS?j?????X?V?@?\???????I?y???[?V???????O?????????????????????B

IPS ?????A?b?v?f?[?g ?@?\?? IPS ?o?[?W???? 6.1 ???????????A?K???I???X?P?W???[???????????u?? IPS ?V?O?j?`?????A?b?v?f?[?g???????P?????@???????????^???????B

?uNote: ?????????????e???W???X?e?B?? Taliaferro?A?^?b?h ?v?[???????? SID Chandrachud ?????????ACisco TAC ?G???W?j?A???????????????B

?O??????

?v??

?????????????????m?????????????????????????????B

?g?p?????R???|?[?l???g

???????????L?????????????????? IPS ?o?[?W???? 6.1 ?????? ???? ???~?????????????????B

?????????????????A?????????{???????????f?o?C?X???????????????????????????B ???????????g?p?????f?o?C?X???A???????????i?f?t?H???g?j?????????N?????????????B ?R?}???h?????????????l?b?g???[?N???^?????e?????????????????????????????????B

?\?L?@

?h?L???????g?\?L?????????A?w?V?X?R ?e?N?j?J?? ?e?B?b?v?X???\?L?@?x???Q???????????????B

?l?b?g???[?N?v??

  1. IPS ???R?}???h?????????? ?C???^?t?F?[?X?? HTTPS ?iTCP 443?j?????????g?p?????C???^?[?l?b?g???_?C???N?g?A?N?Z?X?? HTTP ?i80?j TCP ?K?v?????????B

  2. ???[?^???????t?@?C?A?E?H?[???????????G?b?W?E ?f?o?C?X???l?b?g???[?N?E?A?h???X ???? ?iNAT?j???????A?N?Z?X?R???g???[?? ?A?N?Z?X?E?R???g???[???E???X?g?iACL?j?? IPS ???????????????????????C???^?[?l?b?g???????????K?v???????????B

  3. ???????????e?t?B???^?[???????l?b?g???[?N ?g???t?B?b?N ?V?F?[?p?[?????R?}???h?????????? ?C???^?t?F?[?X IP ?A?h???X?????O???????????B

  4. ?????X?V?@?\???v???L?V?T?[?o???????????????T?|?[?g?????????B

?V?O?j?`???????A?b?v?f?[?g?v???Z?X

???????v???Z?X????:

ips-automatic-signature-update-01.gif

  1. IPS ?? 198.133.219.25 ?ipre-7.0.8?j?????? 72.163.4.161 ?i7.0.8 ?????????????~?j?? Auto Update Server ?? HTTPS ?i443?j TCP ???g?p?????F?????????B

  2. IPS ???v???b?g?t?H?[?? ID ???????V?X?R IPS ?Z???T?[???M???????m?F?????????T?[?o???g?p???????????????????L?????????? Auto Update Server ???????????N???C?A???g???????????????B

  3. ?F?????????A?A?b?v?f?[?g ?T?[?o???????????T?[?o???????????v???b?g?t?H?[?? ID ???????????A?t?????????_?E?????[?h ?t?@?C???I?v?V?????????X?g?????????????????B ???????????????????f?[?^???X?V?o?[?W?????A?_?E?????[?h???????????T?|?[?g???????t?@?C?? ?]?? ?v???g?R???????A?????????????????????B ?????f?[?^???????????AIPS ?I?[?g?X?V???W?b?N???_?E?????[?h ?I?v?V?????????????????????L?????????A?_?E?????[?h???I?????????????????????????X?V?v???O???? ?p?b?P?[?W???m?F???????B ?_?E?????[?h?????????A?T?[?o???A?b?v?f?[?g ?t?@?C???????????????????g?p?????????????g???L?[?? IPS ???^???????B

  4. IPS ???????????T?[?o?????????????_?E?????[?h ?T?[?o???V???????????m?????????B ?_?E?????[?h ?T?[?o??IP?A?h???X?????????????A???u???????????????B

  5. IPS ???????????T?[?o???w???????t?@?C?????_?E?????[?h ?f?[?^ URL ?????`???????t?@?C?? ?]?? ?v???g?R?????g?p???????i?????g?p HTTP ?i80?j TCP?j?B IPS ???X?V?v???O???? ?p?b?P?[?W???????????????????O???_?E?????[?h???????L?[???g?p???A?????Z???T?[?????? ?t?@?C?????????????B

????

?????X?V?@?\?? IPS ?f?o?C?X?}?l?[?W???iIDM?j?????? Express ?iIME?j IPS ?}?l?[?W?????????????????????????????B ?????????????s???????B

  1. IDM/IME ?????A> ?Z???T?[???? > ????/Cisco.com ?A?b?v?f?[?g ?wConfiguration?x ???I?? ???????????B

    ips-automatic-signature-update-02.gif

  2. ?C?l?[?u?? ?V?O?j?`?????????G???W?? ?A?b?v?f?[?g???E?y?C???? Cisco.com ?`?F?b?N?{?b?N?X?????I?????A???? ?y?C?????p?????????????u???[ Cisco.com ?T?[?o?????^?C?g?????N???b?N???????????B

  3. CCO ???[?U?? ?????? ?p?X???[?h?????????????????B

    ?uNote: Cisco.com URL ?????X???????????????B ???????f?t?H???g???????????X???????K?v?????????????????????????B

    7.0(8) ?O???A?????????????????????K?v??????????:

    https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
    

    7.0(8) ?????? 7.1(5) ?????????????????~?A?????????????????????K?v??????????:

    https://72.163.4.161//cgi-bin/front.x/ida/locator/locator.pl
    

    ?uNote: URL ?????W???????????????B //???v???I?A?????^?C?v?G???[?????B

    ips-automatic-signature-update-03.gif

  4. ?V?O?j?`???A?b?v?f?[?g???X?P?W???[?????????????J?n?????????????g???????????????????B ???????????A?????? 23:15:00 ?????? ?????????B ???g???????????????T?|?[?g???????????????????????????????????????????A?b?v?f?[?g???????????B ?????????R???t?B?M?????[?V???????X???????????????wApply?x ???N???b?N ???????????B

    ?uNote: ?????A?????????A8:00?A13:00 ?????? 15:00 ???????????????_?????????????????? ?????????????????????B

    ips-automatic-signature-update-04.gif

  5. ?I?[?g ?A?b?v?f?[?g???????????????????????m?F???????????A?????????????????????? IPS CLI ?????? show statistics host ?R?}???h?????s??????????:

    IPS#show statistics host
    <Output truncated>
    Auto Update Statistics
       lastDirectoryReadAttempt = 16:55:03 GMT-06:00 Wed Jun 27 2012
        =   Read directory: http://CCOUser@72.163.7.55//swc/esd/06/273556262/guest/
        =   Success
       lastDownloadAttempt = 16:55:03 GMT-06:00 Wed Jun 27 2012
        =   Download: 
    http://CCOUser@72.163.7.55//swc/esd/06/273556262/guest/IPS-sig-S654-req-E4.pkg
        =   Success
       nextAttempt = 17:55:00 GMT-06:00 Wed Jun 27 2012
      lastInstallAttempt = 16:55:46 GMT-06:00 Wed Jun 27 2012
       =   Success
    <Output truncated>

????????

???????????V?O?j?`???A?b?v?f?[?g?? IPS ???\?t?g?E?F?A ?o?C?p?X?E ???[?h?????????????????????????K?\???\?????R???p?C???????????????v?????????B ?g???t?B?b?N???C???X?y?N?V???????????C?????C?? ?C???^?[?t?F?C?X???????C?????C?? VLAN ?y?A???t???[?????????????????????o?C?p?X?E ???[?h???????????????????C?????C?? ?Z???T?[?????????????? ?G???W?????o?C?p?X?????????B ?o?C?p?X?E ???[?h?????????????A?C?????C?? ?Z???T?[???A?b?v?f?[?g???K?p???????????A?g???t?B?b?N???????????????????~???????B

?g???u???V???[?e?B???O

?I?[?g ?V?O?j?`???A?b?v?f?[?g???????????????????A???????????????????????????????A???????????????????????X?e?b?v????????????????:

  1. AIM ?????? IDSM ?????????????? IPS ?A?v???C?A???X?????????W???[?????????????A?R?}???h???????????? ?C???^?t?F?[?X???L?? ?? IP ?A?h???X/?T?u?l?b?g?E ?}?X?N/?Q?[?g?E?F?C???????????????????[?J?? ?l?b?g???[?N???????????C???^?[?l?b?g?? IP???B?????????????????????????B AIM ?????? IDSM ???W???[?????????????Avirtual ?R?}???h?????????? ?C???^?t?F?[?X???????????`???????????????p?????????B CLI ???????C???^?[?t?F?C?X?????????????m?F???????????A???? show ?R?}???h????????????????:

    IPS#show interfaces
    <Output truncated>
    MAC statistics from interface Management0/0
       Interface function = Command-control interface
       Description = 
       Media Type = TX
       Default Vlan = 0
       Link Status = Up  <---
    <Output truncated>
  2. CCO???[?U?A?J?E???g???V?O?j?`???A?b?v?f?[?g ?p?b?P?[?W???_?E?????[?h?????K?v?????????????????????????????????? Web?u???E?U???J???A???????? CCO ?A?J?E???g?? Cisco.com ?????O?C?????????????B ?F?????????A?????????V?? IPS ?V?O?j?`?? ?p?b?P?[?W???_?E?????[?h???????????B ???????p?b?P?[?W???_?E?????[?h?????s???\?? IPS ?T?u?X?N???v?V???????????????[?U?A?J?E???g???A?\?V?G?[?V?????????@???????????L???? Cisco?T?[?r?X?????B

  3. ?C???^?[?l?b?g ?o?C???h???????g???t?B?b?N?????????v???L?V???????????????m?F???????????B ?R?}???h???????R???g???[?? ?|?[?g???????g???t?B?b?N???????v???L?V???????????????A?I?[?g ?A?b?v?f?[?g ?@?\???????????????B ?R?}???h???????R???g???[?? ?|?[?g ?g???t?B?b?N???v???L?V?????????t?B???^?????O???????????\?????A???x?e?X?g?????????????????l?b?g???[?N???B

  4. ?p?X???????R???e???c?t?B???^?????O???????g???t?B?b?N?E ?V?F?[?s???O ?A?v???P?[?V???????????A?v???C?A???X???C???^?[?l?b?g???????????????m?F???????????B ???????????A?R?}???h?????????? ?C???^?t?F?[?X?? IP ?A?h???X?????????????C???^?[?l?b?g???A?N?Z?X?????????????O?????????????????B

  5. ICMP ?g???t?B?b?N???C???^?[?l?b?g?????????????????????AIPS ?Z???T?[?? CLI ???J???A?p?u???b?NIP?A?h???X?? ping ???????????????????????B ?????e?X?g???K?v?????[?e?B???O?????? NAT ???[?????i?????g?p???????????????j???????????????????????????m?F?????????g?p???????????????????B ICMP ?e?X?g?????????????????????I?[?g?X?V?????s?????????????????p?X?????????????????[?^???????t?@?C?A?E?H?[???????????l?b?g???[?N ?f?o?C?X IPS ?R?}???h?????????? ?C???^?t?F?[?X IP ?????? HTTPS ?????? HTTP ?Z?b?V???????????????B ?????????A?R?}???h?????????? IP ?A?h???X?? 10.1.1.1 ?????AASA ?t?@?C?A?E?H?[???????P?? ACL????????????????????????????????????????:

    access-list INSIDE-TO-INTERNET extended permit tcp host 10.1.1.1 any eq www
    access-list INSIDE-TO-INTERNET extended permit tcp host 10.1.1.1 any eq https
  6. CCO ???[?U????@???????????A???????????????????????A?????????B ?????????????? Cisco ?o?O ID CSCsq30139 ???Q?????????????B

  7. ?V?O?j?`???????A?b?v?f?[?g???Q???f?f???????????AHTTP ?G???[ ?R?[?h?????m ???????????B

    IPS#show statistics host
    Auto Update Statistics
    lastDirectoryReadAttempt = 19:31:09 CST Thu Nov 18 2010
    = Read directory: https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl
    = Error: AutoUpdate exception: HTTP connection failed [1,110]   <--
    lastDownloadAttempt = 19:08:10 CST Thu Nov 18 2010
    lastInstallAttempt = 19:08:44 CST Thu Nov 18 2010
    nextAttempt = 19:35:00 CST Thu Nov 18 2010
    ???b?Z?[?W ????
    Error: AutoUpdate ???O: HTTP?????? [1,110] ???s???????? ?F???????s?????????B ???[?U?? ?????? ?p?X???[?h???`?F?b?N???????????B
    status=false AutoUpdate ???O: ???V?[?u HTTP?????? [3,212] ???s???????? ???????v?????? Auto Update Server ?????v???B
    Error: HTTP ?G???[????: 400 ?V?X?R URL ???????f?B?t?H???g?????????????m?????????????B CCO ID ???????? 32 ???????????????????A???? CCO ID ???????????????B ???????V?X?R ?_?E?????[?h ?T?[?o???????????????????????????B
    Error: AutoUpdate ???O: HTTP?????? [1,0] ???s???????? ?l?b?g???[?N?????????_?E?????[?h???h???????????????_?E?????[?h ?T?[?o???????????????I?????????????????B

?????@?\?g??

?????????@?\?g??????:

Cisco サポート コミュニティ - 特集対話

Cisco サポート コミュニティでは、フォーラムに参加して情報交換することができます。現在、このドキュメントに関連するトピックについて次のような対話が行われています。


???A????