topic learning IDS? in Network Security

learning IDS?

lukeprimm — Sun, 10 Mar 2019 12:40:15 GMT

I would like to get some sort of IDS box for my lab to work on while I study. Any recomendations? At my workplace we use SSM modules in our 5540's but we dont have nay in a lab environemnt and I really dont think they would appreciate me flipping switches on them.

I saw the 4200 series boxes, would they load 7. code? I also thought about a 5505 with an SSM module. Any feedback is appreciated, thanks

learning IDS?

sawgupta — Tue, 08 May 2012 03:35:20 GMT

Yes you can run 7.0.x code on 42xx series boes.

On 4270, you can load 7.1.3 or later.

Regards,

Sawan Gupta

learning IDS?

a.matahen — Tue, 08 May 2012 06:18:11 GMT

Hello Lukeprimm,

Yes true you shouldn't used the SSM used in your live envirnoment because while configuring the device you can easily get the CPU to go up to 100% which can cause problems if your SSM was implemented in Inline mode.

If you want to practice the GUI i would say the cheapest IPS available out there would do the job.

HTH.

AMatahen

learning IDS?

lukeprimm — Tue, 08 May 2012 14:08:32 GMT

what about the 4215? ITs the most economical unit. Thanks

Re: learning IDS?

a.matahen — Wed, 09 May 2012 16:08:12 GMT

Hello Lukeprimm,

Apologies for the delay in replying.

The 4215 only works in IDS mode, no IPS, so it can only work in promiscous mode not in Inline mode, Unless you get a 4FE PCI card please check:

http://www.cisco.com/en/US/docs/security/ips/5.0/configuration/guide/cli/cliinter.html#wp1040331

If that suits you! then indeed this is the best option available!

HTH

AMatahen