Cisco IPS/IDS

ISR Built-in NIPS config

Step 1 Specify the location of the SDF—Various SDFs can exist in the Cisco IOS

device, but only one can be referenced.

! step 1 – define the location of the SDF

Router(config)#ip ips sdf ?

builtin Use the built in signature definition file

location Location of the signature definition file

Step 2 Configure the failure parameter—This tells the Cisco IOS device what

to do if the signature microengine (SME) is not available to scan the traffic.

! step 2 – define the behavior if an SME fails

Router(config)#ip ips fail ?

closed Do not forward traffic of the failed module.

Router(config)#ip ips fail closed

Step 3 Create an IPS rule—This creates a name that is later applied to an interface.

The rule uses the SDF previously defined. Optionally, an access control list

(ACL) can be applied to restrict which traffic is scanned.

! step 3 – create an IPS rule, and optionally apply an ACL

Router(config)#ip ips name ?

WORD Name of IPS rule

Router(config)#ip ips name testips ?

list Specify an access list to match

Router(config)#ip ips name testips list 123

Step 4 Apply the IPS rule to an interface—Once the rule has been created, it must

be applied to an interface to become operational.

! step 4 – apply the IPS rule to

Router(config)#interface fastethernet 0/0

Router(config-if)#ip ips testips ?

in Inbound IPS

out Outbound IPS

Router(config-if)#ip ips testips in

Router(config-if)#

Additional config