Security Configuration Guide: Cisco IOS Intrusion Prevention System Cisco IOS Release 15.1M&T

Cisco Services for IPS on IOS

Note Effective with Cisco IOS Release 15.1(4)M, this feature is not available in Cisco IOS software.

The Cisco Services for IPS on IOS feature enforces the presence of a valid Intrusion Prevention System (IPS) subscription license before loading signatures released beyond a certain date when the IOS IPS is enabled. A Cisco Services for IPS contract must be purchased or renewed in order to be able to load new signatures; otherwise, the feature will not detect or stop the new attacks making the feature useless.

This feature adds license checking to the signature packages that are distributed by Cisco Systems, Inc. and loaded on IOS Integrated Services Routers (ISR). IOS IPS is enabled on ISRs to detect and act on signatures. Signature packages are created by the signature team and distributed on www.cisco.com. As the signature package is loaded on the ISR, a check is performed to see if there is a valid subscription license for loading IPS signatures. The date of the signature releases contained in the package are checked against the expiration date of the subscription license. Any signatures that are released before the expiration date are loaded and those released after the expiration date are not loaded.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Cisco Services for IPS on IOS" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Prerequisites for Cisco Services for IPS on IOS

•Restrictions for Cisco Services for IPS on IOS

•Information About Cisco Services for IPS on IOS

•How to Work with Cisco Services for IPS on IOS

•Configuration Examples for Cisco Services for IPS on IOS

•Additional References

•Feature Information for Cisco Services for IPS on IOS

Prerequisites for Cisco Services for IPS on IOS

•A user must purchase a Cisco Services for IPS service contract, using the proper contract Stock Keeping Unit (SKU) like CON-SU1-C2811-SEC, for the specific router.

•An IPS signature subscription license file is required to be loaded to enable loading of new signatures on that particular router. After purchasing an SKU, an IPS-related license file can be downloaded from www.cisco.com/go/license via the "Licenses not requiring a PAK" link.

•The router needs to be configured to run the IOS IPS feature, although a contract purchase or a license is not needed to configure and run IOS IPS on any router.

Restrictions for Cisco Services for IPS on IOS

•Except for service providers and partners who buy a "Shared Support" contract, Cisco Services for IPS on IOS is always tied into a smartNet (Hardware and Software) support contract.

•A subscription license will not work on 87x, 720x and 7301 routers, regardless of contract purchase.

Information About Cisco Services for IPS on IOS

Before using Cisco Services for IPS on IOS, you should understand the following concepts:

•Cisco Services for IPS Service Contract

•Cisco IOS IPS Subscription License Details

•Cisco IOS IPS Signature Package

•IPS Subscription License Verification

•Cisco IOS Licensing Installation, Administration and Management

Cisco Services for IPS Service Contract

Cisco Services for IPS is a service contract that includes smartNet services along with an IPS signature update subscription, that allows generation of an IPS subscription license file that is unique for the router the service contract has been sold for.

For further information on Cisco Services for IPS, see the Cisco Services for IPS document.

Cisco IOS IPS Subscription License Details

A Cisco IOS IPS Subscription License is a license to enable a router to load signatures released after a certain date. It is not a license to either turn on the IPS feature or to download IPS signature packages from CCO.

Cisco CA will require a Cisco Services for IPS contract purchase to generate a license file based on the router Product ID (PID) and Serial Number (SN). A 60-day trial license can be generated once for each PID and SN combination (also called UDI - Universal Device Identifier).

Cisco IOS IPS Signature Package

A Cisco IOS IPS Signature Package is a data file that is used to configure an IOS IPS feature on the router with signatures to scan traffic. The file is packaged using scripts maintained by the Cisco signature team. The IOS IPS signature data file is posted to CCO for download at:

http://tools.cisco.com/support/downloads/go/Model.x?mdfid=281442967&mdfLevel=Software%20Family&treeName=Security&modelName=Cisco%20IOS%20Intrusion%20Prevention%20System%20Feature%20Software&treeMdfId=268438162

The signature file may be downloaded and loaded on the router(s). There is no license required to download the signature package from CCO or copy it to a router but a valid ios_ips_update license file is required to load (compile) signatures released after a certain date into the router's tables used to scan traffic.

IPS Subscription License Verification

Cisco IOS Software Licensing (CSL) provides a framework for verifying licenses on a router running Cisco IOS software. IOS IPS needs to query CSL to determine if the license file is valid and that the router has permission to load the latest signature update.

If the license is valid, the new signatures may be loaded. If the license is not valid or unavailable, the signature will not be loaded. If the license is expired, only those signature updates that were produced before the license expiration date may be loaded.

Cisco IOS Licensing Installation, Administration and Management

For information on IOS licensing installation, administration, and management, refer to the "Related Documents" section.

How to Work with Cisco Services for IPS on IOS

This section contains the following task:

•Displaying the Status of an IPS License

Displaying the Status of an IPS License

Perform this task to display the status of a license. The show ip ips license command displays IPS license information. This information includes the license expiration date and the version date of the existing loaded signatures, as well as the highest version date of last signature package loaded. If the license is still valid, the existing loaded signature version will be the same as the last signature package.

SUMMARY STEPS

1. enable

2. show ip ips {all | configuration | interfaces | license | name name | sessions [detail] [vrf vrf-name] | signatures [detail] | statistics [reset] [vrf vrf-name]}

DETAILED STEPS

Configuration Examples for Cisco Services for IPS on IOS

This section provides the following examples:

•Displaying Valid License Details: Example

•Displaying the Details of an Expired License: Example

•Displaying the Details for an Uninstalled License: Example

Displaying Valid License Details: Example

The following task displays the details of a valid license:

Router# show ip ips license

IPS License Status Valid

Expiration Date: 2009-12-31

Signatures Loaded: 2009-06-25 S375

Signature Package: 2009-06-25 S375

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-06-25 S375), and the version date of the last signature package loaded (2009-06-25 S375). The license is valid as the existing loaded signature version date is the same as the last signature package version date. The last signature package date (2009-06-25) is also before the license expiration date (2009-12-31).

Displaying the Details of an Expired License: Example

The following example displays the details of an expired license:

Router# show ip ips license

IPS License Status Expired

Expiration Date: 2009-12-31

Signatures Loaded: 2009-12-25 S393

Signature Package: 2010-03-10 S402

Note the license expiration date (2009-12-31), the version date of the existing loaded signatures (2009-12-25 S393), and the version date of the last signature package loaded (2010-03-10 S402). The license has expired as the existing loaded signature version date is not the same as the last signature package version date. The last signature package date (2010-03-10) is also after the expiration date (2009-12-31).

Displaying the Details for an Uninstalled License: Example

The following example displays the details of an uninstalled license:

Router# show ip ips license

IPS License Status Not installed

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Cisco Services for IPS on IOS

Table 1 lists the release history for this feature.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2011 Cisco Systems, Inc. All rights reserved.