Cisco IPS 4200 Series Sensors

In today's busy network environment, business continuity relies on effective network intrusion prevention to stop malicious attacks, worms, and application abuse before they affect your data and resources. Cisco® IPS 4200 Series Sensors and Cisco IPS Sensor Software are core components of Cisco's intrusion prevention solution. Using Cisco IPS Sensor Software's inline prevention technology, Cisco IPS 4200 Series Sensors accurately detect, classify, and stop malicious traffic on IPv4 and IPv6 networks.

Product Overview

Intelligent Detection

• Cisco IPS technology is engineered to prevents malicious activity, including worms, directed attacks, distributed denial of service attacks, reconnaissance, and application abuse.

• Built on advanced Cisco security and network intelligence, modular inspection capabilities can detect and prevent threats to the entire network stack, from applications to Address Resolution Protocol (ARP). Cisco IPS technology extends this expertise by providing industry-leading protection from evasion.

• Cisco IPS provides adaptive vulnerability and anomaly detection. Signatures are focused on vulnerabilities, so your ability to detect threats remains intact, even as exploits change. For emerging "zero-day" threats, a Cisco IPS sensor learns about your network, detects behavioral anomalies, and mitigates attacks without a signature update.

• Cisco IPS is the only intrusion prevention systems that use Global Correlation. Global Correlation harnesses the power of Cisco Security Intelligence Operations, the world's largest threat monitoring network, to achieve unprecedented threat management efficacy. Global threat information is turned into actionable intelligence, such as reputation scores, and pushed out to all enabled technologies. Using Global Correlation, Cisco IPS can stop twice the amount of malicious activity that traditional signature-only IPS technologies can, and with fewer false positives. With Global Correlation updates every five minutes, the Cisco IPS can also adjust to changing threat conditions 100 times faster than signature updates alone.

• Cisco IPS technology and signature services are developed by an extensive global team of Cisco security experts. These experts conduct ongoing research into emerging threats, inspection methods, and prevention strategies, in order to continue to deliver up-to-date vulnerability-based signatures and advanced intrusion prevention capabilities.

Precision Response

• Cisco IPS sensors provide you with the most knowledge of potential threat impact by calculating a real-time measurement of risk for every event. An adaptive multidimensional algorithm combines attack and attacker details with live global and network knowledge to produce a calibrated risk measurement.

• Cisco IPS sensors have the richest set of response actions for flexible and precise response policies. You can tailor your IPS policy to each network environment and threat-directly dropping packets, terminating sessions, and rate limiting, or implementing access control and rate limiting on routers and other security appliances throughout the network.

• Cisco IPS threat rating assesses post-response residual risk, enabling incident handlers to focus on the highest-impact events. Risk measurements are updated following an active response to prioritize events with the greatest potential to impact your business.

• Cisco IPS sensors record live, in-depth information on every alert, enabling incident handlers to rapidly diagnose and resolve events. Context data and session logging provide packet-level detail before, during, and after each event.

Intrusion Prevention for the Self-Defending Network

Integrated

• The most diverse line of IPS sensors provides the right tool for the right job, anywhere in the network

• Intrusion prevention is integrated into the fabric of the network

• Solution is built on Cisco security and network intelligence

• Adaptive

• Modular inspection engines provide rapid response with minimal downtime

• Behavioral anomaly detection protects against zero-day attacks

• Dynamic risk-based threat rating adapts policy to attacks in real time

• Collaborative

• On-box, networkwide, and global correlation provides greater confidence

• Network and endpoint collaboration provide greater visibility and effectiveness

• A common, solution-based management interface helps reduce operational costs

Policy-Based Management

• Cisco IPS 4200 Series Sensors reduce the time and effort required to implement security measures by using management and correlation tools that focus on policy, yet provide the granularity you need to fine-tune your IPS configuration.

• Instantly increase your security visibility and define your inspection policy, with integrated graphical management and event viewing tools.

• Gain a unified, end-to-end view of your security posture and a holistic approach to security incident management, with the Cisco Security Monitoring, Analysis, and Response System (MARS).

• Reduce the cost of change and configuration management activities, using the rich Cisco Security Manager graphical interface to update policies on thousands of devices in a few simple steps.

Enterprise Resilience

• Cisco IPS 4200 Series Sensors are designed to withstand failures and minimize downtime, giving you the assurance that your IPS solutions can bear the most strenuous peaks of your day-to-day operations.

• Built-in, comprehensive monitoring detects potential failures at every level of operation, including devices, services, communications, and monitoring link failures.

• Automated and manual fail-open options enable you to define the right policy for a worst-case scenario, whether no packet should pass unexamined, or your traffic must flow-no matter what. Integrated hardware bypass enables you to extend this policy to total system and power failures.

Flexible Deployment

• Cisco IPS 4200 Series Sensors can be deployed in an inline IPS configuration, a promiscuous IDS configuration, or both inline and promiscuous simultaneously.

• Your critical assets on IPv4 and IPv6 networks can be protected with a single Cisco IPS 4200 Series Sensor for maximum deployment flexibility and lower total cost of ownership. Cisco IPS 4200 Series Sensors provide investment protection for customers planning or considering migration to IPv6 or hybrid IPv4 and IPv6 networks.

• Appliances in the Cisco IPS 4200 Series are available in a variety of multiple-interface configurations, featuring copper and fiber Gigabit Ethernet, and 10 Gigabit Ethernet interfaces. You can also configure thousands of logical interfaces and implement intrusion prevention within your VLAN environment, giving you the design flexibility to address all of your deployment requirements, from simple to complex.

• Cisco IPS technologies also feature industry-leading virtualization capabilities. Virtual sensors enable the virtualization of both the configuration and the sensor state.

Figure 1. Deployment Scenarios for Cisco IPS 4200 Series Sensors

Delivering Performance

Media-Rich

Transactional

Figure 2. Network Environment Spectrum: Transactional to Media-Rich

Product Specifications

Table 1. Product Specifications

	Cisco IPS 4270	Cisco IPS 4260	Cisco IPS 4255	Cisco IPS 4240
Performance: Media-rich	4 Gbps	2 Gbps	600 Mbps	300 Mbps
Performance: Transactional	2 Gbps	1 Gbps	500 Mbps	250 Mbps
Standard monitoring interface	Four 10/100/1000BASE-TX or four 1000BASE-SX	10/100/1000BASE-TX	Four 10/100/1000BASE-TX	Four 10/100/1000BASE-TX
Standard command and control interface	10/100/1000BASE-TX	10/100/1000BASE-TX	10/100BASE-TX	10/100BASE-TX
Optional monitoring interfaces	• Four 10/100/1000BASE-TX • Two 1000BASE-SX (fiber) (up to 16 total monitoring interfaces)	• Four 10/100/1000BASE-TX (up to 9 monitoring interfaces) • Two 1000BASE-SX (up to 4 fiber monitoring interfaces)	None	None
Redundant power supply	Yes	Optional	No	No
Automated hardware fail- open	Yes*	Yes*	Yes**	Yes**
Form factor	Four rack units	Two rack units	One rack unit	One rack unit
Height	6.94 in. (17.6 cm)	3.45 in. (87.6 mm)	1.72 in. (4.37 cm)	1.72 in. (4.37 cm)
Width	19 in. (48.3 cm)	17.14 in. (435.3 mm)	17.25 in. (43.82 cm)	17.25 in. (43.82 cm)
Depth	26.5 in. (67.3 cm)	20 in. (508 mm)	14.5 in. (36.83 cm)	14.5 in. (36.83 cm)
Weight	80 lb (36.3 kg)	40 lb (18.14 kg) (when fully loaded)	20 lb (9.07 kg)	20 lb (9.07 kg)
Rack-mountable	Yes	Yes	Yes	Yes
Auto-switching	100 to 240 VAC	100 to 240 VAC	100 to 240 VAC	100 to 240 VAC
Frequency	50 to 60 Hz, single-phase	47 to 63 Hz, single-phase	47 to 63 Hz, single-phase	47 to 63 Hz, single-phase
Operating current	12.0A (100 VAC), 4.9A (200 VAC)	8.9A (100 VAC), 4.5A (200 VAC)	3.0A	3.0A
Operating temperature	10 to 35°C (50 to 95°F)	10 to 35°C (50 to 95°F)	0 to 40°C (32 to 104°F)	0 to 40°C (32 to 104°F)
Nonoperating temperature	-40 to 70°C (-104 to 158°F)	-40 to 70°C (-104 to 158°F)	-20 to 65°C (-4 to 149°F)	-20 to 65°C (-4 to 149°F)
Operating relative humidity	10 to 90% (noncondensing)	10 to 85% (noncondensing)	10 to 85% (noncondensing)	10 to 85% (noncondensing)
Nonoperating relative humidity	5 to 95% (noncondensing)	5 to 95% (noncondensing)	5 to 95% (noncondensing)	5 to 95% (noncondensing)
Heat dissipation @ full power	1893 Btu/hr	648 Btu/hr	614.2 Btu/hr	614.2 Btu/hr

Ordering Information

Table 2. Ordering Information

CE Marking

Cisco Services for IPS

• Signature file updates and alerts

• Registered access to Cisco.com for online tools and technical assistance

• Access to Cisco Technical Assistance Center (TAC)

• Cisco IPS software updates

• Advance replacement of failed hardware

Export Considerations

Additional Information