topic Enable Ping Signature on cisco IPS in Network Security

Enable Ping Signature on cisco IPS

alkabeer80 — Sun, 10 Mar 2019 12:39:58 GMT

Hi,

I have enabled signature for ping 2000 and 2004 and i have set them sev to high still i am not get alert.

I also did nmap attack and it give alert

how can i achieve this ?

thanksssssssssss

Enable Ping Signature on cisco IPS

Todd Pula — Wed, 02 May 2012 21:23:10 GMT

2000 and 2004 are retired by default now. You will need to make sure that you both enable and unretire these signatures before testing.

Enable Ping Signature on cisco IPS

ruppala — Fri, 04 May 2012 23:43:36 GMT

Signature 2000-0 triggers on ICMP Echo Replies and 2004-0 triggers on ICMP Echo Requests. Note that these are

extremely common network traffic. If you have enabled and unretired the sigs and if the sigs fire when tested using NMAP, they seem to be working fine. May be theres some other device on your network thats blocking such packets.

Enable Ping Signature on cisco IPS

alkabeer80 — Sat, 05 May 2012 07:51:00 GMT

thx Todd Pula and ruppala,

i enable the signature and unretire it it is working, i want to ask why the signature get retired ????

another question i have alot of signature that is not enabled i want to enable all of them for alerting, can i do it without going to each single one and enable it i.e is there anyway (like script) i can u se to enable all of them in one time ???

thankssssssssssssssssssssssssssssssss

Enable Ping Signature on cisco IPS

sawgupta — Sun, 06 May 2012 10:59:03 GMT

Unretiring and enabling many signatures would have a performance impact. Only unretire and enable those signatures which are really important.

Regards,

Sawan Gupta

Enable Ping Signature on cisco IPS

alkabeer80 — Sun, 06 May 2012 19:00:34 GMT

thx sawan,

what about enabling more than one signature for alerting (config. from CLI) is this applicable ?

thankssssssssssss

Enable Ping Signature on cisco IPS

sawgupta — Mon, 07 May 2012 00:53:21 GMT

Yes, enabling a few signatures is fine.

Regards,

Sawan Gupta

Enable Ping Signature on cisco IPS

alkabeer80 — Mon, 07 May 2012 04:11:39 GMT

thx sawan, i think i did not explain what is my problem exactly.

i have 1000 signature in IPS (not enabled), i want to enable all of them, i dont want to pass all of them one by one and enable it.

Is there away i can do it, may be some command i can issue ???

thankssssssssssssssssss

Enable Ping Signature on cisco IPS

sawgupta — Mon, 07 May 2012 04:26:49 GMT

Yes using IDM you can select multiple signatures and right-click -> Enable.

Regards,

Sawan Gupta

Enable Ping Signature on cisco IPS

alkabeer80 — Tue, 08 May 2012 06:18:26 GMT

thx Sawan, Todd, ruppla

Enable Ping Signature on cisco IPS

andrea sentali — Mon, 21 Oct 2013 07:48:52 GMT

Un-retire the echo request signature (signature 2004, subsig ID 0), enable it and change the signature action to

alert, and drop.

R1(config)# ip ips signature-definition

R1(config-sigdef)# signature 2004 0

R1(config-sigdef-sig)# status

R1(config-sigdef-sig-status)# retired false

R1(config-sigdef-sig-status)# enabled true

R1(config-sigdef-sig-status)# exit

R1(config-sigdef-sig)# engine

R1(config-sigdef-sig-engine)# event-action produce-alert

R1(config-sigdef-sig-engine)# event-action deny-packet-inline

R1(config-sigdef-sig-engine)# exit

R1(config-sigdef-sig)# exit

R1(config-sigdef)# exit

Do you want to accept these changes? [confirm]

Re: Enable Ping Signature on cisco IPS

andduart — Mon, 28 Oct 2013 04:45:32 GMT

Hi,

Maybe as a personal suggestion you can use the summary option for these type of signatures so you wont see or get all the alerts, you can have a summary of them at a time to have some of them fired

Regards,

Sent from Cisco Technical Support iPhone App

which kinds of signatures we

nounouna341 — Mon, 20 Apr 2015 11:01:10 GMT

which kinds of signatures we can test with nmap (the id of signature )pleaseeee