CCNP BCMSN Exam Certification Guide (3rd Edition)

IOS IDS

IOS IPS

Router(config)# ip ips sdf location url

PIX

1.

Download the signature update file.

You can download the signature update files to your local workstation by following these steps:

1. Point your web browser to http://www.cisco.com.

2. Select Downloads.

3. Select Cisco Secure Software.

4. Under Intrusion Detection, look for the IOS IPS Update Files section.

5. Follow the Latest Signature Update link, and then select a signature update file to download.

NOTE

The signature update files are named according to the sensor platform and are numbered sequentially. Each time a new update is released, the signature file number is incremented. The most recent signature update file is comprehensiveit always has the new updates, as well as all the previously released signatures.

For example, the file named IOS-S139.zip contains the newly released signatures as well as signatures from IOS-S138.zip, IOS-S135.zip, and so on.

After the signature update file is downloaded to your local workstation, don't attempt to unzip it or manually upload it to the router. The entire installation is done auto-matically through a management application.

2.

Install the signature update file on a router platform.

Currently, the only way to upload and install a signature update file is through the Security Device Manager (SDM) application. This is a Java-based management application that is installed and run on the router platform. All management functions are performed through a web browser on a workstation.

SDM is available only on select router platforms and in Cisco IOS software releases that support security functions. You can go to http://www.cisco.com/go/sdm to find out more about SDM.

1. Start an SDM session with the target router.

   Point your web browser to https://router-ip-address. When the main SDM window appears, click the Configure button. In the list of buttons on the left side, click Intrusion Prevention.

2. Begin IPS signature management.

   In the Intrusion Prevention System (IPS) screen, click the Launch IPS... button. This initiates a new application window.

3. In the main SDM Intrusion Prevention window, click the Configure button.

4. Under Tasks, click Rules. All the router interfaces are displayed, along with the IPS status of each. Make sure IPS (inbound, outbound, or both) is enabled on the appropriate interfaces. To do this, select an interface in the table and then click the Enable button above the table. The display should update to show the new interface status.

5. Display a listing of the signatures that are currently installed in the router. Do this by clicking the Signatures button in the Tasks list on the left. The signature list should look similar to the one shown in Figure 13-2.

   Figure 13-2. Generating a List of Current IPS Signatures

6. To upload and import the new signature update file, click the Import button located just above the signature table. Select the folder and filename where the signature update file is stored, and then click the Open button.

7. The file is uploaded to the router, and SDM shows a list of its signatures in a new window. The signatures in the file are not automatically imported into the router's IPS feature. Instead, you have to manually select the signatures you want to import from this list, as shown in Figure 13-3.

   Figure 13-3. Displaying a List of Signatures in the Update File

8. Import a signature by selecting it from the Available Signatures list on the left and clicking the >> button. The signature is shown in the Signatures to be added list on the right. After you select and copy all the desired signatures, click the OK button.

1.

(Optional) Use the Post Office system for IDS alarms.

TIP

When Post Office attributes are changed on a router, they take effect only after a router reloads. This includes enabling Post Office, as well as configuring or changing the IP addresses of Post Office collectors. You can use any of Steps 1a through 1g to make configuration changes at any time without affecting router operation. However, you must schedule a network downtime or outage, because the router is reloaded to implement the Post Office changes.

NOTE

Post Office support was removed as of Cisco IOS software Release 12.3(11)T. It was replaced by the Security Device Event Exchange (SDEE) protocol.

1. (Optional) Send IDS alarms to an external collector (non-Syslog):

   IOS IDS	Router(config)# ip audit notify nr-director
   IOS IPS	Router(config)# ip audit notify sdee
   PIX

   By default, an IOS IDS sensor sends its alarms using Syslog, and an IOS IPS sensor does not. If you are using VMS or Cisco Secure IDS Director, you can use this command to send alarms using the Post Office protocol instead. (Here, the nr portion of the nr-director keyword comes from the name of the legacy Cisco NetRanger product line.)

   For an IOS IPS sensor, you can use the sdee keyword to send alarms using SDEE. The router's internal HTTP server must also be enabled with the following command so that SDEE clients can register with the router via HTTP:

   Router(config)# ip http server

2. (Optional) Identify the IDS sensor for Post Office:

   IOS IDS	Router(config)# ip audit po local hostid host-id orgid org-id
   IOS IPS
   PIX

   When sending alarms to a Post Office collector, the IDS sensor must identify itself within the Post Office hierarchy. You can assign this sensor to have host ID host-id (1 to 65535; the default is 1) within the organization ID org-id (1 to 65535; the default is 1). The host-id must be unique within the org-id.

3. (Optional) Identify a Post Office collector:

   IOS IDS	Router(config)# ip audit po remote hostid host-id orgid org-id rmtaddress ip-address localaddress ip-address [port port-number] [preference preference-number] [timeout seconds] [application {director | logger}]
   IOS IPS
   PIX

   The collector is identified by its host ID host-id (a unique number 1 to 65535; the default is 1), within organization ID org-id (1 to 65535; the default is 1).

   The sensor must also identify the collector and itself by keywords and IP addresses rmtaddress ip-address and localaddress ip-address, respectively. UDP port number port-number (1 to 65535; the default is 45000) is used for all Post Office packets.

   Multiple "routes" can exist for the same collector if redundant paths or interfaces are present. Each time this command is repeated for the same remote collector, you can assign a preference as preference-number (the default is 1) to the remote IP address. Lower preferences are tried first; if one collector is unresponsive, the sensor moves to the next higher-preference entry.

   Sensors use a heartbeat message, sent every timeout seconds (the default is 5 seconds), to determine if a remote collector is alive and responsive.

   A sensor can also send alarms to an application collector, such as Cisco Secure IDS Director (director, the default), or to an IDS sensor appliance, such as Cisco Secure IDS Sensors (logger).

4. (Optional) Adjust the Post Office message queue:

   IOS IDS	Router(config)# ip audit po max-events number-of-events
   IOS IPS
   PIX

   The IOS IDS sensor queues number-of-events (1 to 65535; the default is 100) alarms or events to be sent to a collector. This queue buffers rapidly occurring alarms if the alarm messages can't be sent to a collector quickly enough.

   TIP

   Be careful if you decide to change the event queue limit. Each event in the queue takes up 32 KB of router memory. If the queue is allowed to grow very large, it could use up too much memory needed by other processes.

5. (Optional) Identify Post Office protected addresses:

   IOS IDS	Router(config)# ip audit po protected ip-addr [to ip-addr]
   IOS IPS
   PIX

   When an IOS IDS sensor triggers a signature alarm, it also sends a flag to the collector to indicate whether the alarm involves an IP address on the "protected" side of the sensor. You can define a single IP address as ip-addr or a range of addresses as ip-addr to ip-addr.

   You can repeat this command to define as many protected addresses or ranges as needed.

6. (Optional) Limit the number of SDEE clients:

   IOS IDS
   IOS IPS	Router(config)# ip sdee subscriptions subscriptions
   PIX

   By default, only one SDEE client is allowed to connect for IOS IPS alerts. You can adjust that limit to subscriptions (1 to 3).

7. (Optional) Adjust the SDEE event queue size:

   IOS IDS
   IOS IPS	Router(config)# ip sdee events events
   PIX

   As IPS events occur, alerts are placed in a queue until the SDEE client polls for them. By default, up to 200 events can be stored in the circular event queue. You can adjust the event queue size to events (10 to 1000 events; the default is 200).

2.

Use Syslog for IDS alarms.

This step shows only the basic Syslog configuration steps needed for IDS logging. For more information on PIX platforms, see Chapter 9, "Firewall Logging." In Chapter 12, "Cisco IOS Firewall: Managing Activity," see section 12-2, "Configuring IOS Firewall Logging," for information on router platforms.

1. Enable Syslog logging:

   IOS IDS	Router(config)# logging on
   IOS IPS	Router(config)# logging on
   PIX	Firewall(config)# logging enable

   When logging is enabled, both firewalls and routers generate logging messages to any destinations that are configured.

2. Identify a Syslog server:

   IOS IDS	Router(config)# logging host ip_address
   IOS IPS	Router(config)# logging host ip_address
   PIX	Firewall(config)# logging if_name host ip_address

   The router or firewall sends Syslog messages to the Syslog server at ip_address. On a firewall, the Syslog server can be found on the firewall interface named if_name ("outside," for example). This command can be repeated to define additional Syslog servers. Be aware that each Syslog message is replicated for each server that is configured, causing additional CPU and traffic loads.

3. (Optional) Set the Syslog logging severity level:

   IOS IDS	Router(config)# logging trap level
   IOS IPS	Router(config)# logging trap level
   PIX	Firewall(config)# logging trap level

   Syslog messages are sent to the server only if they are equal to or lower than the severity level (0 to 7; a lower number means higher severity). By default, Cisco firewalls use severity level 3 (errors), and routers use severity level 6 (informational).

   Severity can be given as one of these keywords or level numbers: emergencies (0), alerts (1), critical (2), errors (3), warnings (4), notifications (5), informational (6), or debugging (7).

   TIP

   IDS sensors (both firewall and router) send alarms using Syslog severity level 4 (warnings). Therefore, make sure you set the severity level to 4 or greater. Generally, the higher the severity number, the more non-IDS firewall or router activity messages you see.

   All IOS router IDS sensor Syslog messages begin with %IDS-4-type: Sig: signature-ID :message_text. All PIX IDS messages begin with %PIX-4-4000nn IDS:number message_text. You can easily search the logging messages to find IDS-related alarms. As well, the signature ID number is contained in each message.

4. (Optional) Use a specific source address:

   IOS IDS	Router(config)# logging source-interface mod type/num
   IOS IPS	Router(config)# logging source-interface mod type/num
   PIX	Firewall(config)# logging device-id ipaddress if_name

   By default, a router or firewall sends Syslog messages with a source address of the exiting interface. On a router platform, you can specify an interface to use as the source address for all Syslog messages. On a firewall, the Syslog source address cannot be configured. However, the firewall can insert a "device ID" field into the text of each Syslog message, consisting of the IP address of a specific interface. In either case, the predictable IP address serves as a way to make the IDS sensor always appear as a single address in the activity logs.

5. Send alarms through Syslog:

   IOS IDS	Router(config)# ip audit notify log
   IOS IPS	Router(config)# ip ips notify log
   PIX

   By default, Syslog alerts are sent by router and firewall IDS systems, but not by routers using IOS IPS. You must enable the alerts with this command. You can send IOS alarms to both external collectors and Syslog servers if needed. In this case, you must use this command to enable Syslog notifications after you use the ip audit notify command with the nr-director or sdee keyword.

   A PIX IDS sensor sends all its alarms using Syslog, so no additional command is needed.

3.

(Optional) Define default signature actions.

1. Define default actions for info signatures:

   IOS IDS	Router(config)# ip audit info action [alarm] [drop] [reset]
   IOS IPS
   PIX	Firewall(config)# ip audit info action [alarm] [drop] [reset]

   By default, all "info" type signatures trigger only an IDS alarm to a Syslog server or PO collector. You can change the default behavior using any combination of the keywords alarm (sends an IDS alarm), drop (drops the detected packet), and reset (resets the detected TCP connection).

   TIP

   On an IOS IPS router platform, the action taken for "info" type signatures is predefined in the signature definition file. You can use the show ip ips signature command to see a summary of the actions. For example, the following signatures are listed with actions designated by A (alarm), D (drop), and R (reset):

   Router# show ip ips signature Signatures were last loaded from disk0:/attack-drop.sdf SDF release version attack-drop.sdf v2 *=Marked for Deletion Action=(A)larm,rop,(R)eset Trait=AlarmTraits MH=MinHits AI=AlarmInterval CT=ChokeThreshold TI=ThrottleInterval AT=AlarmThrottle FA=FlipAddr WF=WantFrag Ver=Signature Version Signature Micro-Engine: SERVICE.SMTP (1 sigs) SigID:SubID On Action Sev Trait MH AI CT TI AT FA WF Ver ----------- -- ------ ---- ----- ----- ----- ----- ----- -- -- -- --- 3129:0 Y ADR MED 0 0 0 0 15 FA N S59 Signature Micro-Engine: SERVICE.RPC (29 sigs) SigID:SubID On Action Sev Trait MH AI CT TI AT FA WF Ver ----------- -- ------ ---- ----- ----- ----- ----- ----- -- -- -- --- 6100:0 Y AD HIGH 0 0 0 100 30 FA N 1.0 6100:1 Y ADR HIGH 0 0 0 100 30 FA N 1.0 [output omitted]

2. Define default actions for attack signatures:

   IOS IDS	Router(config)# ip audit attack {action [alarm] [drop] [reset]}
   IOS IPS
   PIX	Firewall(config)# ip audit attack {action [alarm] [drop] [reset]}

   By default, all "attack" type signatures trigger only an IDS alarm to a Syslog server or PO collector. You can change the default behavior to any combination of these keywords: alarm (sends an IDS alarm), drop (drops the detected packet), and reset (resets the detected TCP connection).

   The IOS IPS attack actions are also predefined and cannot be changed.

4.

Define signature exemptions.

NOTE

You can find a complete list of signatures and signature IDs supported by firewall and router IDS sensors in section 13-4.

1. Globally disable a signature:

   IOS IDS	Router(config)# ip audit signature signature_id disable
   IOS IPS	Router(config)# ip ips signature signature_id[:sub-signature_id] disable
   PIX	Firewall(config)# ip audit signature signature_id disable

   By default, all available signatures are enabled and used for inspection. You can disable a specific signature by giving its signature_id (900 to 50000). You can repeat this command to globally disable multiple signatures.

   If you repeatedly see signatures triggered for traffic that is expected or permitted, you might consider disabling those signatures. For example, if your security policies permit ICMP echo and echo reply packets to pass into and out of your network, you probably wouldn't want to see IDS signatures triggered for those packets. On a PIX platform, you could disable signature 2000 (ICMP Echo Reply) with the following command:

   Firewall(config)# ip audit signature 2000 disable

2. Exempt traffic from matching a signature.

   Sometimes, you may need to conditionally disable a signature so that some specific types of traffic can't trigger it. On Cisco router IDS sensors, you can define an ACL that permits traffic to be exempted from the signature. Cisco firewall IDS sensors don't offer this capability.

   To create an access list that denies the exemption, you would enter the following command sequence:

   IOS IDS	[View full width] Router(config)# access-list acl-list deny source_addr mask Router(config)# access-list acl-list permit any
   IOS IPS	[View full width] Router(config)# access-list acl-list deny source_addr mask Router(config)# access-list acl-list permit any or [View full width] Router(config)# access-list acl-list deny ip source_addr mask destination_addr mask Router(config)# access-list acl-list permit ip any any
   PIX

   For an IOS IDS platform, a standard IP access list numbered acl-list (1 to 99) is used to identify the traffic that is exempt from a signature match. Use one or more deny statements first to define the source address(es) that bypass the inspection. Here, the source_addr can be an IP address and mask (0 bits match and 1 bits are wildcards) or the host keyword with an IP address.

   End the ACL with a permit any statement so that all other source addresses are subject to matching the signature.

   An IOS IPS platform can use a standard IP access list, an extended IP access list, or a named IP access list to trigger the exemption. Again, use a deny statement to define the exemption and end the list with a permit ip any any statement.

   To apply the ACL to a signature ID, you would enter the following command:

   IOS IDS	Router(config)# ip audit signature signature_id list acl-list
   IOS IPS	Router(config)# ip ips signature signature_id[:sub-signature_id] list acl-list
   PIX

   For an IOS IDS platform, the standard IP access list acl-list (1 to 99) is used during the inspection process for signature ID signature-id (900 to 50000). If the ACL denies a source address, it is exempt from triggering the signature. In other words, the ACL permits traffic to be matched against the signature.

   An IOS IPS platform, however, can use a standard, extended, or named IP access list.

   You can repeat this command to apply the same ACL to other signatures if needed.

5.

Define an inspection rule:

Before IDS can be enabled on the sensor, you must define a policy that tells the sensor what action to take. The exception is an IOS IPS sensor; a policy must still be defined, but the signature actions are predefined in the SDF and cannot be altered.

The policy named audit_name (an arbitrary text string of up to 16 characters) applies to info or attack signatures. You can specify one or more of the following actions to be taken on the traffic that triggered the signatures: alarm (sends a Syslog or PO alarm), drop (drops the offending packet), and reset (resets the offending TCP connection). If you omit the action keyword, only the default alarm action is performed.

TIP

You should define a policy for "info" signatures and a policy for "attack" signatures, as shown in the command syntax.

On router IDS sensors, you can use the same policy name for both info and attack actions. Policies defined on IOS IPS platforms are automatically applied to all signatures for both info and attack actions. On firewall IDS sensors, however, the info and attack policies must be named differently.

6.

(Optional) Adjust the SMTP spam attack threshold:

Signature ID 3106 detects an e-mail spam attack if a message is sent by SMTP to an excessive number of recipients. You can set the spam detection threshold to number-of-recipients (1 to 65535; the default is 250) for a single e-mail message.

7.

(IOS IPS only) Control IPS behavior.

1. (Optional) Don't load the default built-in signatures:

   IOS IDS
   IOS IPS	Router(config)# no ip ips sdf builtin
   PIX

   By default, if the router can't download the SDFs, it begins using the set of signatures that is built into the IOS image itself. This might happen if the SDF doesn't exist or if the router can't contact an external server where the SDF is stored.

   You can use this command to force the router to disable IPS completely if the SDF can't be downloaded.

2. (Optional) Stop forwarding until the IPS is ready:

   IOS IDS
   IOS IPS	Router(config)# ip ips fail closed
   PIX

   By default, if there is a problem loading the SDF or signature engines, the router forwards traffic normally. You can use this command to force the router to drop all packets until the complete IPS is loaded and functional. By doing this, you can make sure that all traffic is inspected before it is forwarded.

8.

Enable the IDS on an interface:

A firewall IDS sensor can apply the audit policy to an interface only as a whole. This means that the same policy is applied to inbound and outbound traffic on the interface named if_name automatically.

IOS IDS

[View full width]

ip audit notify nr-director ip audit po remote hostid 1 orgid 100 rmtaddress 192.168.199.200 localaddress 192.168.199.1 port 45000 preference 1 timeout 5 application director ip audit po local hostid 4 orgid 100 exit copy running-config startup-config reload

IOS IPS

ip audit notify sdee ip http server [no reload is necessary]

IOS IDS

logging host 192.168.199.100 logging trap warnings logging on ip audit notify log

IOS IPS

logging host 192.168.199.100 logging trap warnings logging on ip ips notify log

IOS IDS

ip audit name MyIDS info action alarm ip audit name MyIDS attack action alarm drop reset interface fastethernet 0/0 ip address 172.16.1.1 255.255.255.0 ip audit MyIDS in ip audit MyIDS out

IOS IPS

ip ips name MyIDS interface fastethernet 0/0 ip address 172.16.1.1 255.255.255.0 ip ips MyIDS in ip ips MyIDS out

IOS IDS

ip audit signature 2004 disable access-list 9 deny host 192.168.199.13 access-list 9 permit any ip audit signature 3106 list 9

IOS IPS

ip ips signature 2004 disable access-list 9 deny host 192.168.199.13 access-list 9 permit any ip ips signature 3106 list 9