topic Re: ids 4200 syslog in Network Security https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154536#M77078 <HTML><HEAD></HEAD><BODY><P>one more question. Simple network with PIX outside and inside network. I was just looking at how these things go together. Customer wants ids mode. I assume you span ports to make it work? Also, placement better to have it on the internet side or the inside? thx again</P></BODY></HTML> Wed, 27 May 2009 20:04:25 GMT whanson 2009-05-27T20:04:25Z ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154532#M77068 <P>Customer doesn't want to use MARS. Any recommendations on decent syslog server?</P><P></P><P>thx again</P> Sun, 10 Mar 2019 11:38:20 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154532#M77068 whanson 2019-03-10T11:38:20Z Re: ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154533#M77070 <HTML><HEAD></HEAD><BODY><P>The IPS sensor does not support syslog. It can only send SNMP traps to remote destinations. A good tool to store IPS sensor events is Cisco IME, and its free! Have a look at:</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/go/ime" target="_blank">www.cisco.com/go/ime</A></P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 26 May 2009 13:07:13 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154533#M77070 Farrukh Haroon 2009-05-26T13:07:13Z Re: ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154534#M77073 <HTML><HEAD></HEAD><BODY><P>you are a peach...thx</P></BODY></HTML> Tue, 26 May 2009 15:52:41 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154534#M77073 whanson 2009-05-26T15:52:41Z Re: ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154535#M77076 <HTML><HEAD></HEAD><BODY><P>No problem, I'm glad you find the link useful <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Tue, 26 May 2009 18:13:19 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154535#M77076 Farrukh Haroon 2009-05-26T18:13:19Z Re: ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154536#M77078 <HTML><HEAD></HEAD><BODY><P>one more question. Simple network with PIX outside and inside network. I was just looking at how these things go together. Customer wants ids mode. I assume you span ports to make it work? Also, placement better to have it on the internet side or the inside? thx again</P></BODY></HTML> Wed, 27 May 2009 20:04:25 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154536#M77078 whanson 2009-05-27T20:04:25Z Re: ids 4200 syslog https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154537#M77080 <HTML><HEAD></HEAD><BODY><P>I would place it behind the firewall's outside interface. But this all depends on your security policy and how your network is setup. </P><P></P><P>Another factor is your IPS device's throughput. Can it sustain the load from the internal LAN? If so you can also place it behind the PIX firewall. This will give you protectional for both internal an external threats.</P><P></P><P>I would setup the IPS in inline interface pair mode.</P><P></P><P>Have a look at this link:</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00809c37cb.shtml" target="_blank">http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00809c37cb.shtml</A></P><P></P><P>Please rate if helpful.</P><P></P><P>Regards</P><P></P><P>Farrukh</P></BODY></HTML> Thu, 28 May 2009 06:41:38 GMT https://community.cisco.com/t5/network-security/ids-4200-syslog/m-p/1154537#M77080 Farrukh Haroon 2009-05-28T06:41:38Z