topic Re: Test IOS IPS in Network Security

Test IOS IPS

mike.f — Sun, 10 Mar 2019 09:33:10 GMT

How do you test a IOS IPS setup on a routers external interface checking inbound data is

working.

I have set it to notify via syslog (ip ips notify log) and i know the syslog

is working as an ACL is also set to log to syslog and this is showing

results on the syslog server.

I have tried sending (what i'm told is a ping of death) to the routers

external interface (ping -l 65500 ipaddress) but this shows on the syslog

server as being denied by the ACL but dosen't trigger a signature in the

IPS.

Is there a way of testing it from a windows platform?

Re: Test IOS IPS

vasthorvak — Tue, 26 Jul 2005 12:15:27 GMT

try running a port scan on a network behind the router using something like

nmap -sT -T Insane "network here"

This should trigger an alert so you can test it.

Re: Test IOS IPS

bramsamy — Tue, 26 Jul 2005 12:40:47 GMT

Generate the required traffic using the NMAP application

you can get the alert Messages from the router itself , Please make use of the SDEE messages which will give the Complete info of the alerts generated ,

eg :: ip ips sdee alerts

ip ips sdee events

Make sure the sdee is enabled on the router