topic Does Pix 6.22 include IDS in Network Security

Does Pix 6.22 include IDS

mitchell_kohn — Fri, 21 Feb 2020 06:46:54 GMT

Hi, I noticed that there is a monitoring piece in my PDM that includes IDS. But when I looked at the histories, there wasn't anything there. Is there something special to make it work, or is it a separate piece of hardware ?

Thanks

Re: Does Pix 6.22 include IDS

devam — Tue, 03 Jun 2003 19:35:23 GMT

PIX IOS has IDS with Limitied features. These features can identify certain attack signatures. Based on the configuration the malicious packets can be blocked etc.

Thank you.

Murthy.

Re: Does Pix 6.22 include IDS

bikmann — Tue, 03 Jun 2003 20:32:52 GMT

My understanding is that IDS is already active by default. As Murthy suggested, it is an option to buy for more Intrusion Detection Signatures. By default I believe it comes with some standard 50 to 55 signatures.

Re: Does Pix 6.22 include IDS

shannong — Tue, 03 Jun 2003 22:30:15 GMT

The IDS features of the Pix are VERY limited and are not enabled by default. They are enabled per interface using the [ip audit] commands.

They are very basic and cannot be upgraded as an option. New Pix code releases are the only method to "upgrade" the IDS signatures. For example, pix 6.3.1 code included a few new signatures above 6.2.2.

Re: Does Pix 6.22 include IDS

mitchell_kohn — Wed, 04 Jun 2003 11:51:36 GMT

It seems like I can not put in anything under policy to interface mappings via PDM or cli. What am I missing ?

Thanks.

Re: Does Pix 6.22 include IDS

shannong — Thu, 05 Jun 2003 13:58:58 GMT

These commands would create to IP audit polices that both "alarm" only and applies them to the outside interface:

ip audit name outside-ids info action alarm

ip audit name outside-ids2 attack action alarm

ip audit interface outside outside-ids2

Re: Does Pix 6.22 include IDS

mitchell_kohn — Thu, 05 Jun 2003 17:37:29 GMT

Thanks, I will try it.