IPS and CSM FlexConfig

Similar Questions

• question on the EMI and CSM

  Hello

  I installed IME to a server to manage the network IPS of 6500 package, and I would like to install on the same MCS server to manage the same Catalyst 6500 FWSM. I have several questions:

  -Can I have installed and running in the server IME and CSM sane?

  -CSM contain the same features EMI and much more?, I mean, that's enough with the CSM to manage FWSM and IDS-2 network of 6500 modules?

  -Do the MSC provides a better view of the FWSM newspapers than other applications? Which is the best tool to view the logs of the FWSM, I want to say is a tool like view newspaper checkpoint for FWSM?

  -My client has 2 Catalyst 6500 and 1 installed in each 6500 FWSM, two FWSM mode active/pasive redundancy, I consume 1 or 2 licenses of CSM?

  Thank you

  Kind regards

  Juan Luis.

  Hi Juan,

  - Can I have installed and running in the sane server IME and CSM?

  Yes.

  - Does CSM contain the same functionality of IME and more?, I mean, it is enough with CSM to manage FWSM and IDS-2 network modules of 6500?

  EMI offers various functions such as archiving and image management and implementation at level automatically and taking automatic backups, etc.

  - Does CSM provide a better view of FWSM logs than other applications?. Which is the better tool to view the logs of FWSM, I mean is there a tool like checkpoint log view for FWSM?

  CSM 4.0 is a tool that allows to display, filter, grep etc syslogs of all firewalls and IDSes.

  - My customer has 2 catalyst 6500 and 1 FWSM installed in each 6500, both FWSM running in redundancy active/pasive mode, do I consume 1 or 2 licences of CSM?

  CSM will be manage and watch one active unit only. The day before will just be a copy of the asset. So 1 license for CSM.

  I hope it answers your questions.

  PK

• What are different between the IPS and AIP - SSC and AIP - SSM?

  Dear all,

  I'm not clear about the IPS, AIP - SSC and AIP - SSM module which are different?

  Then, when we can use IP addresses?

  When we use the AIP - SSC?

  When we can use AIP - SSM?

  Thus, a different IPS and AIP - SSC and AIP - SSM material or the same material?

  Best regards

  Rechard

  AIP - SSM is an IPS Firewall ASA module.

  IPS is available in different flavors:

  -Device of the IPS 4200 series

  AIP - SSM - module IPS Firewall ASA

  -IDSM2 - IPS module on 6500 series switch

  AIM - IPS - map IPS on router IOS

  Please rate and mark post useful.

• IPS 4260 - how to see the signature enabled in CLI and CSM

  How many signatures is enabled. ?

  The CSM sees how many signatures is activated?

  and what is the command in the CLI, where can I see how many signatures I've activated

  The IPS Manager Express, it's easy to see how much is activated.

  Better compliance

  René Rolsted

  Through CSM, you can see what are all signatures are enabled.

  If you want to know the County. You must filter the signatures in defining active = True, and then you can export it as a. CSV file. If you open that excellent by sheet.you can get the count.

  It may be useful

  Thnaks,

  Suresh.

• Is it really possible to return signatures IPS of CSM

  Hi people,

  I tried to return IPS signatures that I deployed through policies of the Signature of the CSM to the old version, but it doesn't seem to work. Against this Cisco CSM guide says:

  If you decide that you don't want to apply an update of the signature, you can return to the

  last update by selecting the political level Signatures on the device, by clicking on the view

  Update level button, then click on restore

  I can't imagine that it is possible that the signatures are normally compiled into xml files. How the sensor would he?

  Eugene

  When installing a copy of the files that will be replaced or updated during the installation is copied to a backup directory.

  The CLI has a "downgrade" command that can uninstall the update and backup copies will be used to replace the removed files.

  A few things to know:

  (1) old configuration will be copied back. If the changes made since the update may be lost.

  (2) this only works for Signature and engine updates. Service Packs, minor updates and major updates replace the full operating system, so there is too much data to make backup copies.

  (3) this only works for the update installed. Once you have decommissioned the more recent, you cannot downgrade the earlier.

  (4) this can be done through CLI and now also available in MSC.

  Here are some things to check for in your situation where it seems to not work.

  Log on to the sensor and run 'display the worm '.

  History in the output of 'see the worm' shows a package of Signature Update as the last installed update?

  If it is then either an another downgrade was already completed, or Major Update, minor update, or Service Pack has been installed the last packet and cannot be downgraded.

  If it cannot be done through CSM you could try the CLI' "downgrade" command and see if it works through the CLI or if the CLI gives you an error and the explanation.

• IPS of CSM 4.3 update

  Hello

  I'm trying to download updates cisco.com using CSM (version 4.3) IPS, but it does not work. It was working fine all along until he stopped two days ago. I checked that the server can connect to the internet without any problem. I can use the same credentials from cisco for manual updates and also works perfect.

  confirm settings of setti CSM, all still intact. reconfigured details and still the same issue. I get the following error

  "Unable to communicate with the service locator to retrieve files available.

  Note that I have just same crendentials on my LAB IP addresses and did the automatic update of the installation and it worked fine.

  any idea what the problem might be?

  Kind regards

  There is a new workaround for CSCue16970solution, based on the addition of the certificate to the MCS server.

  1.) Manually download Cybertrust's CA certificate from https://www.cybertrust.ne.jp/SureServer/file/root_ca/BCTRoot.txt . 2.) Save this file as 'trusted.998.crt' in text format and ensure that no extra characters or new lines are added to the original content. Keep in mind that certain Web browsers may add HTML codes when saving text files, so be sure to edit them out. 3.) Exit/close any/all instances of CSM client applications (Configuration Manager, Event Viewer, Health and Performance Monitor, Report Manager, etc.) 4.) On the CSM server, stop the 'Cisco Security Manager Daemon Manager' service by issuing the following command: 'net stop CRMDmgtd'. 5.) On the CSM server, copy the 'trusted.998.crt' file to the 'CSCOpx\MDC\Apache\conf\ssl' directory. 6.) On the CSM server, start the 'Cisco Security Manager Daemon Manager' service by issuing the following command: 'net start CRMDmgtd'. 

• EA6500 - devices get weird IPs and DNS servers

  Hi all

  I have just installed, updated firmware, but even if many problems have arisen, let me please you the list of people:

  (1) cable devices get weird IPs, the printer for instange to 10.168.122.100 always, it happens THAT the devices wired; the QNAP server had once 192.168.100.100, when it happens that of course devices do not appear on the network.
  My understanding is that all devices, related or not, must get the IPs between 192.168.1.100 and 155, it is the default value for the same router;

  (2) my laptop when telegraphed Gets an appropriate IP (192.168.1.xxxx), but STILL Gets a number of strange DNS, 10.168.122.1 server, and the Internet becomes unstable. It only happens in wireframe, when in the wireless, it gets the number of server DNS the same number of IP from the router (192.168.1.1), and the wifi works perfectly. Why get this strange DNS server number in wireframe only?

  (3) my phone VOIP Comwave gets no IP address at all, I tried everything (disconnect, repluigging each device in waiting 5 minutes etc.), nothing worked. She always returns 0.0.0.0

  (4) I tried both Open DNS numbers, and also numbers of DNS of Norton, as well to go through them but IP of the router always appear as a third option.

  Please, does anyone know what is happening?

  Thank you very much

  Mongao

  Hello world

  Thank you for helping; in fact, I think that I understand the question... I'm the one to blame!

  I had connected the LAN terminal VOIP to the router, not the correct terminal WAN; so I think that VOIP box polluted network transmission inside the weird IP numbers; shame on me

  I quickly tested last night and it seems that it works properly now;

  I do not have the issue of the third DNS number (the same as IP routers) appearing in all my devices, even after turning the pair of numbers to OpenDNS in the EA6500;

  Thank you very much

  Mongao

• Techniques need more details 4250XL IPS and IPS-4255

  4250XL IDS launched before the IPS technology, am I right?

  Can I deploy a 4250XL ID as an IPS, if yes, then it's true to upgrade this version IDS 4.1 to IPS ver 5.0

  I add 4 10/100/1000BaseT ports on ID 4250XL.

  Because, I have to deploy IPS to 1 Gbps throughput.

  and I could not find an IPS in CISCO will produce 1 Gbit/s with 4-port 10/100/1000BaseT.

  How many simultaneous sessions support IPS 4200 series.

  How can I use feature Redundant Power Supply on IPS-4255.

  Technical documentation 42xx is linked off the coast of http://www.cisco.com/go/ips. I don't know if IPS 5.0 information is still (it's kinda new). There is no option RPS for the 4240/4255, but recommends the use of a UPS would be justified for packaging line if you have unreliable power.

  There is no provision for failover in the transducer (other than the bypass mode), but there are drawings (I hope bound off the page that I mentioned above) to do network active / standby designs.

  The 4240 and 4255 do not have redundant storage... they have no HDD due to reliability problems. They run a flash and ram disk configuration.

• IPS and switching

  Hello I have a theoretical question on the vlan and IPS

  Suppose that having a 4215 and a router. I want to run the ips with interface in inline mode.

  Would be - here work well?

  Router - WAN

  -Ethernet Vlan 2

  4215

  -L'Ethernet 2-> Vlan 2

  -Vlan 3 3 Ethernet

  -Network inside all in Vlan 3

  Would the bridge IPS if they were all in the same subnet?

  Cisco says

  http://www.Cisco.com/en/us/products/HW/vpndevc/PS4077/products_configuration_guide_chapter09186a00807517bb.html#wp1046883

  If two interfaces are connected to the same switch, you must configure on the switch as access with different access ports VLAN for both ports. Otherwise, the traffic is not transmitted via the online interface.

  Given that I have not read something on the deployment had to ask to be sure 100%

  Yes - you are approaching this correctly.

  On the sensor, you must be sure to complete the pairing of Vlan so that it will act as a bridge between VLAN 2 and 3 L2.

  The other option is to make the IPS on a stick, where you trunk 2 & 3 down to a single physical interface to the 4215.

  Let us know how your project progresses.

  thxs

  Peter

• ASA/IPS and IPS Manager Express

  I am trying to add my sensor to the IPS Manager Express but I keep the following error. IOException when trying to get certificate:java.security.cert.CertificationExpiredException: notafter Sam may 10 * 2008.

  I'm sure it's simple but can find how to solve this problem.

  Kind regards

  D

  This means that the SSL/TLS certificate on the web server of your sensor has expired on May 10, 2008.

  It is very common for the sensors that have been active for more than a year. When a sensor is generated, it is usually valid for only a year or two.

  You just need to create a new SSL/TLS certificate for your sensor.

  Connect on your sensor and run "tls key generate."

  http://www.Cisco.com/en/us/partner/docs/security/IPS/6.1/command/reference/crCmds.html#wp504369

  But remember that, once you do this, you should make sure attend you all other management systems that connect to your sensor and make sure the management system pulls down and accepts this new certificate (which often requires you to push some type of button I agree to the new certificate).

• Check the IPS and HTTPS

  Hello

  Cisco IPS/AIP module identify the HTTPS tunnel torrent traffic?

  IPS can inspect the https traffic to detect any anomaly?

  Kind regards.

  Hello

  In my humble OPINION by default, you cannot inspect all encrypted traffic.

  You need to have traffic ended on the SAA to decipher and then send to the client.

  HTH

  Parasmo

• Cisco IPS and SSL Inspection?

  We recently purchased a Cisco ASA 5512 - X and I'm just curious to know if there is anyway for the ASA tool or a 3rd away work with the ASA, to control traffic SSL Decode/encode? Otherwise, anyone can simply access a web site with ssl for example https://www.youtube.com and bypass the IPS together?

  Kind regards

  Craig

  It won't work with EPI because who can not decrypt the traffic. The new way of "native" to inspect the SSL traffic is to use the ASA-CX:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps6032/ps6094/ps6120/...

  Sent by Cisco Support technique iPad App

• I can't discover a device ips with the CSM, the connectivity test failed!

  Hello world

  As I say I IC discovering my unit IPS with CSM, I have this message:

  The connectivity test failed. Elapsed time: 0 seconds. Expired certificate expiry of the certificate by the device. Certificate of details he received the device: [[Version: V1 subject: CN = X.X.X.X, OR is SSM-IPS10, O is "Cisco Systems, Inc.", C = us Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 key: public module of 1024 bits Sun RSA key:]]

  163313595958527341944117022920288114482504180720578005561064955313643774990976715676633248342066152083691325258722628818351428036183713571418359362172457378662626088225882179602799780417125413462000959388084832050518999958663965078068279649170934515615745020420256153072567949117948346991874191887565159544369

  [public exponent: 65537 validity: [from: Tue Dec 07 10:42:59 THIS 2010, to: Fri Dec 07 10:42:59 HEC 2012] issuer: CN = X.X.X.X, OR is SSM-IPS10, O is "Cisco Systems, Inc.", C = SerialNumber us: [-XXXXXXX]] algorithm: [SHA1withRSA] Signature: 0000: E1 DF 3 a 84 EF E5 C8 F5 F8 EB D1 BA C8 55 54 61:... a... T.. U 0010: F8 E4 54 28 0F 0F DB F8 DB CA 0A 5F 63 B0 0E 0C. T. (..... _c 0020: 4 a 28 46 9th D0 B7 B9 F1 A7 B7 35 95 2 CA EB FD J (F...) 5,... 0030:03 32 D1 1A 13 DB B3 9B C9 E2 E6 22 04 D1 84 3 B. 2... ». ;.. 0040:4 4TH BD D2 E0 25 27 46 5F 1 D ED 39 EC 8F 38 BD MN...%'F_... 9.8 0050: BE ED E8 7 02 AE 62 92 89 66 86 BB B4 B6 FD 1F... b... f... 0060:6 46 27 2 4 b EF F8 C9 1F 81 29 82 C1 AB lF 5F 4F,'K... O..._)... 0070:06 33 0D EA THIS 3F 85 CC 2F 82 6 B 8 90 AND 8 B.3 D8 D6...? ... /...k... ] Please synchronize the time settings on the device and the server of the Security Manager and the time-out value of the certificate, and then generate a new certificate.

  I already generate a new key rsa on the ASA FW IOS version 8.4, my connection is ok and my password. I discovered the FW ASA successfully but not IPS module.

  worm CSM 4.3.0 service pack2

  Thank you for your help.

  This is a common problem with IPS and is easily fixed.

  The IPS uses a self-signed certificate for the protection of its channels of management TLS (Transport Layer Security). When an IPS is initialized who signed a certificate is valid for two years. This certificate is separate from the ASA RSA key.

  To regenerate, please see the procedure described here.

  Do not forget to rate helpful answers and mark your question as answered when solved.

• The ACE IPS Cisco and Cisco ASA AIP - SSM (IPS)

  Is there a difference between the features offered by the Cisco ACE IPS and Cisco ASA AIP - SSM (IPS) devices?

  Can we do without Cisco ASA AIP - SSM (IPS) of 'only' configuration/implementation Cisco ACE IPS.

  Cisco AVS/ACE emphasis on commissioning and to secure web-based applications. IP addresses do not focus on just the web applications and trying to get the multiple layers of the OSI stack. Consider the IPS as a general practitioner and the ACE/AVS as an eye surgeon, or something :)

  Here is the response from Cisco itself:

  http://www.Cisco.com/en/us/prod/collateral/modules/ps2706/ps6906/prod_qas0900aecd8045867c_ps6492_Products_Q_and_A_Item.html

  Q: how is Cisco AVS Firewall application differs from an intrusion prevention system (IPS)?

  A. IPSs are solid solutions of protection against targeted attacks of known vulnerabilities in major platforms such as Windows, Solaris, Apache or Microsoft Internet Information Services (IIS). Cisco AVS excels to protect against targeted attacks Web sites or enterprise applications. These applications can be built custom internal applications or software vendor. Signatures and security patches are generally not available for these types of applications, and building these security levels in each application, it would be almost impossible.

  Q: how is Cisco AVS Firewall application differs by a network firewall?

  A. The Cisco AVS 3120 and Firewall network such as the Firewall of Cisco PIX® and Cisco ASA 5500 Series Adaptive Security appliances are complementary products. The application Cisco AVS Firewall secures Web applications; excellent network in the network security firewall. and the Cisco AVS provides defense in depth for Web applications.

  Firewall network apply policy networks, IP addresses and ports; they have a wide range of application for many different protocols layer features. The firewall can and will be deployed in many locations, including the edge, edge of the enterprise network, branch, etc. Cisco AVS imposed the policy on data HTTP as URL, headers and parameters. Cisco AVS is deployed in the data center in front of Web applications

  Concerning

  Farrukh

• IPS mode vlan inline and VLAN 1

  I am installing a 4255 IPS in pair mode for the vlan inline, but I encountered a problem.

  The thing is that we have a network with multiple VLANs. Some of the servers as well as some users are connected to VLAN 1. The servers are connected to a separate switch.

  I would like to isolate the servers behind the IP addresses.

  I created a new vlan 90, paired with the VLAN 1 on the IPS and placed the server in the new VLAN 90. But this doesn't seem to work.

  I have tryied to put the trunk of the IPS on the main switch on the switch where the servers are located, but in both cases, it did not work.

  I noticed that this configuration seems to work with VLAN different VLAN 1 but I can't make it work with the VLAN 1.

  Does anyone have an idea what could be the problem?

  Thank you.

  VLAN 1 is by default the Vlan for the trunk port native.

  Traffic vlan native out of the port trunk will not have a header vlan.

  So when the sensor receives the traffic it cannot change the header VLANs for vlan 90.

  The sensor will not add a header vlan for packets that do not contain not one.

  If you have two options.

  Either use a vlan different from 1.

  Or the easier method is to change your switch configuration so that a vlan different is defined as the Vlan for the trunk port native.

  Each switch may be different in order to designate the vlan for the trunk port native.

  For the Cat 6K running IOS is "switchport trunk vlan native.

  http://www.Cisco.com/en/us/partner/docs/switches/LAN/catalyst6500/IOS/12.2Sx/configuration/guide/Layer2.html#wp1034721