Cisco Services for IPS on IOS
Download this chapter
Cisco Services for IPS on IOSCisco Services for IPS on IOS
 Feedback

Contents

Cisco Services for IPS on IOS

Last Updated: August 15, 2012


Note
Effective with Cisco IOS Release 15.1(4)M, this feature is not available in Cisco IOS software.

The Cisco Services for IPS on IOS feature enforces the presence of a valid Intrusion Prevention System (IPS) subscription license before loading signatures released beyond a certain date when the IOS IPS is enabled. A Cisco Services for IPS contract must be purchased or renewed in order to be able to load new signatures; otherwise, the feature will not detect or stop the new attacks making the feature useless.

This feature adds license checking to the signature packages that are distributed by Cisco Systems, Inc. and loaded on IOS Integrated Services Routers (ISR). IOS IPS is enabled on ISRs to detect and act on signatures. Signature packages are created by the signature team and distributed on www.cisco.com. As the signature package is loaded on the ISR, a check is performed to see if there is a valid subscription license for loading IPS signatures. The date of the signature releases contained in the package are checked against the expiration date of the subscription license. Any signatures that are released before the expiration date are loaded and those released after the expiration date are not loaded.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Cisco Services for IPS on IOS

  • A user must purchase a Cisco Services for IPS service contract, using the proper contract Stock Keeping Unit (SKU) like CON-SU1-C2811-SEC, for the specific router.
  • An IPS signature subscription license file is required to be loaded to enable loading of new signatures on that particular router. After purchasing an SKU, an IPS-related license file can be downloaded from www.cisco.com/go/license via the "Licenses not requiring a PAK" link.
  • The router needs to be configured to run the IOS IPS feature, although a contract purchase or a license is not needed to configure and run IOS IPS on any router.

Restrictions for Cisco Services for IPS on IOS

  • Except for service providers and partners who buy a "Shared Support" contract, Cisco Services for IPS on IOS is always tied into a smartNet (Hardware and Software) support contract.
  • A subscription license will not work on 87x, 720x and 7301 routers, regardless of contract purchase.

Information About Cisco Services for IPS on IOS

Cisco Services for IPS Service Contract

Cisco Services for IPS is a service contract that includes smartNet services along with an IPS signature update subscription, that allows generation of an IPS subscription license file that is unique for the router the service contract has been sold for.

For further information on Cisco Services for IPS, see the Cisco Services for IPS document.

Cisco IOS IPS Subscription License Details

A Cisco IOS IPS Subscription License is a license to enable a router to load signatures released after a certain date. It is not a license to either turn on the IPS feature or to download IPS signature packages from CCO.

Cisco CA will require a Cisco Services for IPS contract purchase to generate a license file based on the router Product ID (PID) and Serial Number (SN). A 60-day trial license can be generated once for each PID and SN combination (also called UDI - Universal Device Identifier).

Cisco IOS IPS Signature Package

The latest Cisco IOS IPS signature package can be accessed from Cisco.com using the following URL: http://www.cisco.com/cisco/software/release.html?mdfid=281442967&release=S636&relind=AVAILABLE&flowid=4836&softwareid=280775022&rellifecycle=&reltype=latest

Note
Ensure that you have your Cisco userid, and password to access this URL.
  • The IOS-Sxxx-CLI.pkg file is listed on this web page. See the "Configuring Cisco IOS IPS on Your Router" for more information on creating a directory on the router flash directory where the required signature files and configurations are stored. Alternatively, you can use a Cisco USB flash drive connected to the router's USB port to store the signature files and configurations. The USB flash drive needs to remain connected to the router USB port if it is used as the IOS IPS configuration directory location. IOS IPS also supports any IOS File System as its configuration location with proper write access.

IPS Subscription License Verification

Cisco IOS Software Licensing (CSL) provides a framework for verifying licenses on a router running Cisco IOS software. IOS IPS needs to query CSL to determine if the license file is valid and that the router has permission to load the latest signature update.

If the license is valid, the new signatures may be loaded. If the license is not valid or unavailable, the signature will not be loaded. If the license is expired, only those signature updates that were produced before the license expiration date may be loaded.

How to Work with Cisco Services for IPS on IOS

Displaying the Status of an IPS License

Perform this task to display the status of a license. The show ip ips license command displays IPS license information. This information includes the license expiration date and the version date of the existing loaded signatures, as well as the highest version date of last signature package loaded. If the license is still valid, the existing loaded signature version is the same as the last signature package.

SUMMARY STEPS

1.    enable

2.    show ip ips {all | configuration | interfaces | license | name name | sessions [detail | vrf vrf-name] | signatures [detail] | statistics [reset | vrf vrf-name]}


DETAILED STEPS
 Command or ActionPurpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
show ip ips {all | configuration | interfaces | license | name name | sessions [detail | vrf vrf-name] | signatures [detail] | statistics [reset | vrf vrf-name]}


Example:

Router# show ip ips license

 

Displays license details including the license expiration date, the version date of the loaded signatures, and the highest version date of the last signature package loaded.

 

Configuration Examples for Cisco Services for IPS on IOS

Displaying Valid License Details: Example

The following task displays the details of a valid license: 

Router# show ip ips license
IPS License Status Valid
Expiration Date: 2009-12-31
Signatures Loaded: 2009-06-25 S375
Signature Package: 2009-06-25 S375

Note
The license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-06-25 S375), and the version date of the last signature package loaded (2009-06-25 S375). The license is valid as the existing loaded signature version date is the same as the last signature package version date. The last signature package date (2009-06-25) is also before the license expiration date (2009-12-31).

Displaying the Details of an Expired License: Example

The following example displays the details of an expired license: 

Router# show ip ips license
IPS License Status Expired
Expiration Date: 2009-12-31
Signatures Loaded: 2009-12-25 S393
Signature Package: 2010-03-10 S402

Note
The license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-12-25 S393), and the version date of the last signature package loaded (2010-03-10 S402). The license has expired as the existing loaded signature version date is not the same as the last signature package version date. The last signature package date (2010-03-10) is also after the expiration date (2009-12-31).

Displaying the Details for an Uninstalled License: Example

The following example displays the details of an uninstalled license: 

Router# show ip ips license
IPS License Status Not installed

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Security commands

Cisco License Manager application

Cisco License Manager

MIBs

MIB

MIBs Link

  • CISCO-LICENSE-MGMT-MIB

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for Cisco Services for IPS on IOS

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Table 1Feature Information for Cisco Services for IPS on IOS

Feature Name

Releases

Feature Information

Cisco Services for IPS on IOS

15.0(1)M

The Cisco Services for IPS on IOS feature enforces the presence of a valid IPS subscription license when signatures are loaded on a router where the IOS IPS feature is turned on.

The following commands were introduced or modified: show ip ips.

Disabling of IOS IPS Licensing

15.1(4)M

Effective with Cisco IOS Release 15.1(4)M, the Cisco Services for IPS on IOS feature is not available in Cisco IOS software. The show ip ipscommand license keyword is deprecated.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.