IPS Signature problem
ian g
Member Posts: 29 ■■□□□□□□□□
I'm running into a problem with setting up IPS, and was hoping someone here had some words of wisdom.
I'm using a 7200 platform, virtualized using GNS3. Im running a 12.4(15)T image, and for some reason it's not recogizing my signatures. After finishing the SDM IPS wizard, the only signatures loaded are the 3 default sigs: 5000-0, 5000-1, and 5000-2.
The sig file is IOS-S400-CLI.pkg. I'm suspecting that this is of the old format, and won't compile onto the newer IOS images. Can anyone confirm this? I tried with SDM and CLI, but no luck. When I switched to a 12.4(4)T, everything went fine, but with using an earlier image the wizard obviously didn't match what was shown in the lab. If this file won't work, which ones will?
'preciate the help.
I'm using a 7200 platform, virtualized using GNS3. Im running a 12.4(15)T image, and for some reason it's not recogizing my signatures. After finishing the SDM IPS wizard, the only signatures loaded are the 3 default sigs: 5000-0, 5000-1, and 5000-2.
The sig file is IOS-S400-CLI.pkg. I'm suspecting that this is of the old format, and won't compile onto the newer IOS images. Can anyone confirm this? I tried with SDM and CLI, but no luck. When I switched to a 12.4(4)T, everything went fine, but with using an earlier image the wizard obviously didn't match what was shown in the lab. If this file won't work, which ones will?
'preciate the help.
Comments
-
mikem2te Member Posts: 407I'm running into a problem with setting up IPS, and was hoping someone here had some words of wisdom.
I'm using a 7200 platform, virtualized using GNS3. Im running a 12.4(15)T image, and for some reason it's not recogizing my signatures. After finishing the SDM IPS wizard, the only signatures loaded are the 3 default sigs: 5000-0, 5000-1, and 5000-2.
The sig file is IOS-S400-CLI.pkg. I'm suspecting that this is of the old format, and won't compile onto the newer IOS images. Can anyone confirm this? I tried with SDM and CLI, but no luck. When I switched to a 12.4(4)T, everything went fine, but with using an earlier image the wizard obviously didn't match what was shown in the lab. If this file won't work, which ones will?
'preciate the help.
Found these-
Getting Started with IOS IPS with 5.x Format Signatures ? A Step-by-Step Guide [Cisco IOS Intrusion Prevention System (IPS)] - Cisco Systems
Migrating Cisco IPS Ver 4.x Signature Format to Ver 5.x for Cisco IOS IPS [Cisco IOS Intrusion Prevention System (IPS)] - Cisco Systems
[/FONT]Blog : http://www.caerffili.co.uk/
Previous : Passed Configuring Microsoft Office SharePoint Server 2007 (70-630)
Currently : EIGRP & OSPF
Next : CCNP Route -
ian g Member Posts: 29 ■■□□□□□□□□It just gets wierder: I got another .pkg file from school and this unpacked nicely. It took quite a while as there were a lot more signatures than in the previous package. SDM home page shows 2721 total, 1075 enabled and 323 compiled. IPS status shows the signature id's, description etc.However..... When I go to configure > IPS > Signatures, I get a warning box pop up: 'SDM is unable to get signature details from the router. This might be due to issues in the IOS image that you are using.'
Curious indeed!
I know I should not get transfixed on this, and move on with my studies, but I just want to figure it out. Any ideas?
Model Type: 7206VXR, IOS version 12.4(15)T1. The location for the signatures is at disk0:/ipsdir. -
locked Member Posts: 1 ■□□□□□□□□□Can anyone provide me a link to download a signature file?? Please....