topic Auto-update of IPS rules in Routing and SD-WAN

Auto-update of IPS rules

tobiaseichner — Sun, 03 Mar 2019 23:41:55 GMT

Is there a way to let IPS automatically update with new rules delivered by Cisco or an other trusted source ?

Re: Auto-update of IPS rules

sundar.palaniappan — Sat, 10 Feb 2007 03:22:59 GMT

If you are using IPS MC you can setup auto download and application of update files on the sensors. Here's the link that describes the process.

http://www.cisco.com/en/US/products/ps6498/products_user_guide_chapter09186a00806167eb.html#wp989412

HTH

Sundar

Re: Auto-update of IPS rules

tobiaseichner — Sat, 10 Feb 2007 12:55:10 GMT

Sorry, I had better provided more information about the router and software I use: It is a Cisco 1712 with SDM 2.2 installed.

All I currently can do is to add new SDF files, but I guess that this is no auto-updating process running regularly.

Is there any add-on or something similar that works for my case ?

Re: Auto-update of IPS rules

tobiaseichner — Sat, 10 Feb 2007 13:29:56 GMT

Here is a screenshot. I have added the attack-drop.sdf file as recommended by Cisco's website. Is there anything more I can do ? I guess this adds just default rules, but does not update them regularly.

And may I ask a follow-up question: Is there a way to let the router notify me by e-mail when an intrusion is detected/prevented ? I see the log file ("Monitor", "Logging"), but can't find a way to get notified.