topic Re: Automatic update for IPS on Cisco`s site in Network Security

Automatic update for IPS on Cisco`s site

rodrigo.cisco — Sun, 10 Mar 2019 11:19:57 GMT

Hi all,

with Cisco Service for IPS active my IPS that run in ASA module will be able to download the signatures on Cisco`s Web site and update them alone?

thanks for your help. "Together we are even better"

Re: Automatic update for IPS on Cisco`s site

uchimaku — Fri, 17 Oct 2008 00:41:54 GMT

Yes, If you are running IPS 6.1(1) you can configure a schedule on the sensor to check for any signature updates on CCO , download and install them.

Re: Automatic update for IPS on Cisco`s site

Farrukh Haroon — Sat, 18 Oct 2008 20:11:01 GMT

But please note that even tough its 'possible', its always better to do this manually. Sometimes some signatures generate a lot of false positives and its a good idea to check here on netpro and other places for any problems others are facing before applying signature updates (in production). However most signatures only produce alerts, so its just the noise that will worry ya and 'usually' signature updates don't break anything on the network.

Regards

Farrukh

Re: Automatic update for IPS on Cisco`s site

rodrigo.cisco — Sun, 19 Oct 2008 01:03:18 GMT

Farrukh, Tks for you answer!!!

Could you explain me better why the signature update usually dont break anything? All this (security world) is very new for me.

Thanks you so much

Rodrigo Alves

Re: Automatic update for IPS on Cisco`s site

Farrukh Haroon — Sun, 19 Oct 2008 04:40:51 GMT

Rodrigo that is the case because Cisco usually keeps signatures to only 'Product Alert' by default, and no block/deny actions are performed. The only notable exception is the TCP normalization engine.

Regards

Farrukh