Security Configuration Guide: Cisco IOS Intrusion Prevention System, Cisco IOS Release 15.1M&T
Cisco Services for IPS on IOS
Download this chapter
Cisco Services for IPS on IOSCisco Services for IPS on IOS
Download the complete book
Security Configuration Guide: Cisco IOS Intrusion Prevention System, Cisco IOS Release 15.1M&TSecurity Configuration Guide: Cisco IOS Intrusion Prevention System, Cisco IOS Release 15.1M&T (PDF - 680 KB)
give_us_feedback

Cisco Services for IPS on IOS

Last Updated: May 13, 2011


Note
Effective with Cisco IOS Release 15.1(4)M, this feature is not available in Cisco IOS software.

The Cisco Services for IPS on IOS feature enforces the presence of a valid Intrusion Prevention System (IPS) subscription license before loading signatures released beyond a certain date when the IOS IPS is enabled. A Cisco Services for IPS contract must be purchased or renewed in order to be able to load new signatures; otherwise, the feature will not detect or stop the new attacks making the feature useless.

This feature adds license checking to the signature packages that are distributed by Cisco Systems, Inc. and loaded on IOS Integrated Services Routers (ISR). IOS IPS is enabled on ISRs to detect and act on signatures. Signature packages are created by the signature team and distributed on www.cisco.com. As the signature package is loaded on the ISR, a check is performed to see if there is a valid subscription license for loading IPS signatures. The date of the signature releases contained in the package are checked against the expiration date of the subscription license. Any signatures that are released before the expiration date are loaded and those released after the expiration date are not loaded.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Cisco Services for IPS on IOS

  • A user must purchase a Cisco Services for IPS service contract, using the proper contract Stock Keeping Unit (SKU) like CON-SU1-C2811-SEC, for the specific router.
  • An IPS signature subscription license file is required to be loaded to enable loading of new signatures on that particular router. After purchasing an SKU, an IPS-related license file can be downloaded from www.cisco.com/go/license via the “Licenses not requiring a PAK" link.
  • The router needs to be configured to run the IOS IPS feature, although a contract purchase or a license is not needed to configure and run IOS IPS on any router.

Restrictions for Cisco Services for IPS on IOS

  • Except for service providers and partners who buy a "Shared Support" contract, Cisco Services for IPS on IOS is always tied into a smartNet (Hardware and Software) support contract.
  • A subscription license will not work on 87x, 720x and 7301 routers, regardless of contract purchase.

Information About Cisco Services for IPS on IOS

Cisco Services for IPS Service Contract

Cisco Services for IPS is a service contract that includes smartNet services along with an IPS signature update subscription, that allows generation of an IPS subscription license file that is unique for the router the service contract has been sold for.

For further information on Cisco Services for IPS, see the Cisco Services for IPS document.

Cisco IOS IPS Subscription License Details

A Cisco IOS IPS Subscription License is a license to enable a router to load signatures released after a certain date. It is not a license to either turn on the IPS feature or to download IPS signature packages from CCO.

Cisco CA will require a Cisco Services for IPS contract purchase to generate a license file based on the router Product ID (PID) and Serial Number (SN). A 60-day trial license can be generated once for each PID and SN combination (also called UDI - Universal Device Identifier).

Cisco IOS IPS Signature Package

A Cisco IOS IPS Signature Package is a data file that is used to configure an IOS IPS feature on the router with signatures to scan traffic. The file is packaged using scripts maintained by the Cisco signature team. The IOS IPS signature data file is posted to CCO for download at:

http://tools.cisco.com/support/downloads/go/Model.x?mdfid=281442967&mdfLevel=Software%20Family&treeName=Security&modelName=Cisco%20IOS%20Intrusion%20Prevention%20System%20Feature%20Software&treeMdfId=268438162

The signature file may be downloaded and loaded on the router(s). There is no license required to download the signature package from CCO or copy it to a router but a valid ios_ips_update license file is required to load (compile) signatures released after a certain date into the router’s tables used to scan traffic.

IPS Subscription License Verification

Cisco IOS Software Licensing (CSL) provides a framework for verifying licenses on a router running Cisco IOS software. IOS IPS needs to query CSL to determine if the license file is valid and that the router has permission to load the latest signature update.

If the license is valid, the new signatures may be loaded. If the license is not valid or unavailable, the signature will not be loaded. If the license is expired, only those signature updates that were produced before the license expiration date may be loaded.

Cisco IOS Licensing Installation Administration and Management

For information on IOS licensing installation, administration, and management, refer to the Cisco IOS Licensing Installation Administration and Management.

How to Work with Cisco Services for IPS on IOS

Displaying the Status of an IPS License

Perform this task to display the status of a license. The show ip ips license command displays IPS license information. This information includes the license expiration date and the version date of the existing loaded signatures, as well as the highest version date of last signature package loaded. If the license is still valid, the existing loaded signature version will be the same as the last signature package.

SUMMARY STEPS

1.    enable

2.    show ip ips {all | configuration | interfaces | license | name name | sessions [detail] [vrf vrf-name] | signatures [detail] | statistics [reset] [vrf vrf-name]}


DETAILED STEPS
 Command or ActionPurpose
Step 1 enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2 show ip ips {all | configuration | interfaces | license | name name | sessions [detail] [vrf vrf-name] | signatures [detail] | statistics [reset] [vrf vrf-name]}


Example:

Router# show ip ips license

 

Displays license details including the license expiration date, the version date of the loaded signatures, and the highest version date of the last signature package loaded.

 

Configuration Examples for Cisco Services for IPS on IOS

Displaying Valid License Details Example

The following task displays the details of a valid license:

Router# show ip ips license
IPS License Status Valid
Expiration Date: 2009-12-31
Signatures Loaded: 2009-06-25 S375
Signature Package: 2009-06-25 S375

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-06-25 S375), and the version date of the last signature package loaded (2009-06-25 S375). The license is valid as the existing loaded signature version date is the same as the last signature package version date. The last signature package date (2009-06-25) is also before the license expiration date (2009-12-31).

Displaying the Details of an Expired License Example

The following example displays the details of an expired license:

Router# show ip ips license
IPS License Status Expired
Expiration Date: 2009-12-31
Signatures Loaded: 2009-12-25 S393
Signature Package: 2010-03-10 S402

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-12-25 S393), and the version date of the last signature package loaded (2010-03-10 S402). The license has expired as the existing loaded signature version date is not the same as the last signature package version date. The last signature package date (2010-03-10) is also after the expiration date (2009-12-31).

Displaying the Details for an Uninstalled License Example

The following example displays the details of an uninstalled license:

Router# show ip ips license
IPS License Status Not installed

Additional References

Related Documents

Related Topic

Document Title

IOS License Installation

“Installing and Upgrading Licenses by Using Software Activation Commands” section in the Cisco IOS Software Activation Feature, Release 12.4(20)T

IOS License Administration and Management

"Cisco IOS Software Activation Overview"

Software Activation on Cisco Integrated Routers

"Software Activation on Cisco Integrated Routers"

Cisco License Manager application

Cisco License Manager

Configuring IOS IPS and loading a Signature File

"IPS 5.x Signature Format Support and Usability Enhancements"

Standards

Standard

Title

None

--

MIBs

MIB

MIBs Link

  • CISCO-LICENSE-MGMT-MIB

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

None

--

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for Cisco Services for IPS on IOS

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 1 Feature Information for Cisco Services for IPS on IOS

Feature Name

Releases

Feature Information

Cisco Services for IPS on IOS

15.0(1)M

The Cisco Services for IPS on IOS feature enforces the presence of a valid IPS subscription license when signatures are loaded on a router where the IOS IPS feature is turned on.

The following commands were introduced or modified: show ip ips.

Disabling of IOS IPS Licensing

15.1(4)M

Effective with Cisco IOS Release 15.1(4)M, the Cisco Services for IPS on IOS feature is not available in Cisco IOS software. The show ip ipscommand license keyword is deprecated.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.