The Cisco IOS Intrusion Prevention System (IPS) helps protect your network from attacks by inspecting traffic passing in both directions through any combination of router LAN and WAN interfaces.

Product Overview

In today’s business environment, network intruders and attackers can come from outside or inside the network. They can launch distributed denial-of-service attacks, they can attack Internet connections, and they can exploit network and host vulnerabilities. At the same time, Internet worms and viruses can spread across the world in a matter of minutes. There is often no time to wait for human intervention - the network itself must possess the intelligence to recognize and mitigate these attacks, threats, exploits, worms, and viruses.

The Cisco IOS Intrusion Prevention System (IPS) is an inline, deep-packet inspection-based solution that helps Cisco IOS Software effectively mitigate a wide range of network attacks. Although it is common practice to defend against attacks by inspecting traffic at data centers and corporate headquarters, distributing the network-level defense to stop malicious traffic close to its entry point at branch or telecommuter offices is also critical.

Main Benefits

● Provides networkwide, distributed protection from many attacks, exploits, worms, and viruses exploiting vulnerabilities in operating systems and applications

● Eliminates the need for a standalone IPS device at branch and telecommuter offices as well as small and medium-sized business networks

● Dramatically improves the ease of management of IPS policies through a unique risk-rating-based signature-event-action processor

● Offers field-customizable worm and attack signature set and event actions

● Offers inline inspection of traffic passing through any combination of router LAN and WAN interfaces in both directions

● Works with the Cisco IOS Firewall, control-plane policing, and other Cisco IOS Software security features to protect the router and networks behind the router

Basic and Advanced Signature Categories for IOS IPS

In Cisco IOS Software Release 12.4(11)T and later T-train releases, IOS IPS signature provisioning is accomplished through the selection of one of two signature categories: Basic or Advanced. Users may also add or remove individual signatures and can tune signature parameters using Cisco Configuration Professional or Cisco Security Manager or the command-line interface (CLI), which allows easy scripting to manage signature configuration for a large number of routers.

IOS Basic and Advanced signature categories are preselected signature sets intended to serve as a good starting set for most users of IOS IPS. They contain the latest high-fidelity (low false positives) worm, virus, IM, or peer-to-peer blocking signatures for detecting security threats, allowing easier deployment and signature management. Cisco IOS IPS also allows the selection and tuning of signatures outside those two categories.