topic Re: Pix and IDS in Network Security

Pix and IDS

5creedus — Fri, 21 Feb 2020 08:04:14 GMT

anyone know to configure a pix 500 series to do IDS? according to cisco URL http://www.cisco.com/warp/public/cc/pd/sqsw/sqidsz/ it does a limited (~50 sigid's)

also there is a tac case ID that states it does at URL

http://www.ciscotaccc.com/security/showcase?case=K93520960

however I have not been able to find any documentation on how to configure. I did open a tac case 601113263 and will post the results of that case here once I hear from Cisco

thanks in advance

Re: Pix and IDS

mostiguy — Mon, 11 Apr 2005 18:00:04 GMT

Refer to the ip audit command

Re: Pix and IDS

5creedus — Mon, 11 Apr 2005 19:15:14 GMT

thanks, not very warm and fuzzy for ids on pix least not in a corporate environment.

Re: Pix and IDS

Patrick Iseli — Mon, 11 Apr 2005 23:48:53 GMT

I think the easyest way to configure and to review the list is UNFOTUNENTLY the PDM - PIX DEVICE MANAGER.

I could not find any more the paper with the list of the available 5x signatures.

But do not compare this signature with an IDS system this are mostly Layer 3 signatures eg. LAND attack, icmp packet types, smurf and others. This signature will defently not protect against Application attacks.

sincerely

Patrick

Re: Pix and IDS

5creedus — Mon, 11 Apr 2005 23:52:57 GMT

Thanks, we are trying to convience the customer this is not the way to go and that last tidbit will help, I hope.

Re: Pix and IDS

Patrick Iseli — Tue, 12 Apr 2005 01:51:41 GMT

I finaly found a list of the signatures of the PIX Firewall in the log messages, See Table 2.4.

System Log Messages:

http://www.cisco.com/en/US/partner/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a00800eca3d.html#36557

Command Reference ip audit:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/gl.htm#wp1101884

sincerely

Patrick