Scribd
Upload
349 views3 pages

5.4.1.2 Packet Tracer Configure IOS Intrusion Prevention System IPS Using CLI

The document describes how to configure an Intrusion Prevention System (IPS) on a Cisco router using the command line interface. It involves enabling the IPS feature, configuring logging to a syslog server, modifying an IPS signature to alert and drop ICMP echo reply packets, and verifying that IPS is working properly by checking syslog messages and whether ping attempts succeed between devices.

Uploaded by

Hanen Bouhadda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
349 views3 pages

5.4.1.2 Packet Tracer Configure IOS Intrusion Prevention System IPS Using CLI

The document describes how to configure an Intrusion Prevention System (IPS) on a Cisco router using the command line interface. It involves enabling the IPS feature, configuring logging to a syslog server, modifying an IPS signature to alert and drop ICMP echo reply packets, and verifying that IPS is working properly by checking syslog messages and whether ping attempts succeed between devices.

Uploaded by

Hanen Bouhadda
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

Packet Tracer-Configure IOS Intrusion Prevention System (IPS)

Using the CLI


Topology

Addressing Table

fo
Device Interface IP Address Subnet Mask Default Gateway Switch Port

R1
G0/1
S0/0/0
192.168.1.1
10.1.1.1
.in
255.255.255.0
255.255.255.252
N/A
N/A
S1 F0/1
N/A
pt
S0/0/0 (DCE) 10.1.1.2 255.255.255.252 N/A N/A
fp
R2
S0/0/1 (DCE) 10.2.2.2 255.255.255.252 N/A N/A
.o

G0/1 192.168.3.1 255.255.255.0 N/A S3 F0/1


R3
S0/0/0 10.2.2.1 255.255.255.252 N/A N/A
w

Syslog NIC 192.168.1.50 255.255.255.0 192.168.1.1 S1 F0/2


w

PC-A NIC 192.168.1.2 255.255.255.0 192.168.1.1 S1 F0/3


w

PC-C NIC 192.168.3.2 255.255.255.0 192.168.3.1 S3 F0/2

Objectives
 Enable IOS IPS.
 Configure logging.
 Modify an IPS signature.
 Verify IPS.

Background / Scenario
Your task is to enable IPS on R1 to scan traffic entering the 192.168.1.0 network.
The server labeled Syslog is used to log IPS messages. You must configure the router to identify the syslog
server to receive logging messages. Displaying the correct time and date in syslog messages is vital when
using syslog to monitor the network. Set the clock and configure the timestamp service for logging on the
routers. Finally, enable IPS to produce an alert and drop ICMP echo reply packets inline.
The server and PCs have been preconfigured. The routers have also been preconfigured with the following:

© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 3

www.ofppt.info
Packet Tracer -Configure IOS Intrusion Prevention System (IPS) using CLI

o Enable password: ciscoenpa55


o Console password: ciscoconpa55
o SSH username and password: SSHadmin / ciscosshpa55
o OSPF 101

Part 1: Enable IOS IPS


Note: Within Packet Tracer, the routers already have the signature files imported and in place.They are the
default xml files in flash. For this reason, it is not necessary to configure the public crypto key and complete a
manual import of the signature files.

Step 1: Enable the Security Technology package.


a. On R1, issue the show version command to view the Technology Package license information.
b. If the Security Technology package has not been enabled, use the following command to enable the
package.
R1(config)# license boot module c1900 technology-package securityk9
c. Accept the end user license agreement.

fo
d. Save the running-config and reload the router to enable the security license.

.in
e. Verify that the Security Technology package has been enabled by using the show version command.

Step 2: Verify network connectivity.


pt
a. Ping from PC-C to PC-A. The ping should be successful.
fp

b. Ping fromPC-A to PC-C. The ping should be successful.


.o

Step 3: Create an IOS IPS configuration directory in flash.


On R1, create a directory in flash using the mkdir command. Name the directory ipsdir.
w

Step 4: Configure the IPS signature storage location.


w

On R1, configure the IPS signature storage location to be the directory you just created.
w

Step 5: Create an IPS rule.


On R1, create an IPS rule name using the ip ips name namecommand in global configuration mode. Name
the IPS rule iosips.

Step 6: Enable logging.


IOS IPS supports the use of syslog to send event notification. Syslog notification is enabled by default.If
logging console is enabled, IPS syslog messages display.
a. Enable syslog if it is not enabled.
b. If necessary, use the clock set command from privileged EXEC mode to reset the clock.
c. Verify that the timestamp service for logging is enabled on the router using the show run
command.Enable the timestamp service if it is not enabled.
d. Send log messages to the syslog server at IP address 192.168.1.50.

© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 3

www.ofppt.info
Packet Tracer -Configure IOS Intrusion Prevention System (IPS) using CLI

Step 7: Configure IOS IPS to use the signature categories.


Retire theall signature category with the retired true command (all signatures within the signature release).
Unretire the IOS_IPS Basic category with the retired false command.

Step 8: Apply the IPS rule to an interface.


Apply the IPS rule to an interface with the ip ips name direction command in interface configuration
mode.Apply the rule outbound on the G0/1interface of R1. After you enable IPS, some log messages will be
sent to the console line indicating that the IPS engines are being initialized.
Note: The direction in means that IPS inspects only traffic going into the interface. Similarly,outmeans that
IPS inspects only traffic going out of the interface.

Part 2: Modify the Signature


Step 1: Change the event-action of a signature.
Un-retire the echo request signature (signature 2004, subsig ID 0), enable it, and change the signature action
to alert and drop.

fo
Step 2: Use show commands to verify IPS.
Use the show ip ips allcommand to viewthe IPS configuration status summary.
To which interfaces and in which direction is the iosips rule applied?
.in
_______________________________________________________________________________________
pt
Step 3: Verify that IPS is working properly.
fp

a. From PC-C, attempt to pingPC-A. Werethe pings successful? Explain.


.o

____________________________________________________________________________________
____________________________________________________________________________________
w

b. From PC-A, attempt to pingPC-C. Were the pings successful? Explain.


w

____________________________________________________________________________________
____________________________________________________________________________________
w

Step 4: View the syslog messages.


a. Click the Syslog server.
b. Select theServicestab.
c. In the left navigation menu, select SYSLOG to view the log file.

Step 5: Check results.


Your completion percentage should be 100%.Click Check Results to seefeedback and verification of which
required components have been completed.

© 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 3 of 3

www.ofppt.info

You might also like