topic IPS 4255 in Network Security

IPS 4255

Asif Majeed — Sun, 10 Mar 2019 12:36:14 GMT

Dear all i have an issue while configuring Cisco IPS4255 in lab,

when i configure the two interfaces of device as inline interface pair mode and create an attack using any signature such as 2004 , 11020, 3401 , the actions of signature i.e. deny packet inlinle, or deny connection inline are not working mean that these two options when selected dnt block the packets or connections of specified traffic , although the events show that deny packet inline and deny connection inline are getting true value.

Only option that works from the list is ' deny attacker inline' for any of the signature.

Is that because of licensing issue because my device doe not have valid license installed in it right now or i am not configuring the device properly.

Thx in advance for kind help

asif

IPS 4255

rhermes — Thu, 02 Feb 2012 16:43:40 GMT

The lack of a current license will not prevent proper sensor operation. It should still block traffic as you have configured.

The only limitation of an unlicensed sensor is you can not install signature updates (you can only install software updates).

- Bob

IPS 4255

Asif Majeed — Thu, 09 Feb 2012 05:01:12 GMT

thank you bob for your answer, it is working fine now , you were right, issue was that i did configured event action overriding in IPS and just selected "Deny attacker inline" option, thats why every signature's action was getting override. It is working without license.