topic ips 4255 interface pair in Network Security

ips 4255 interface pair

jcin — Sun, 10 Mar 2019 09:42:00 GMT

Hi,

I'm deploying IPS 4255 (5.0.4) at my customer site. I put the IPS between the internet router and firewall.

Gi0/2 connected to firewall and Gi0/3 connected to router. Is it correct setup?

We use default signature configuration.

After deployed the user can't browse the internet and we saw that there are some of the customer public IP listed in the Actived Host Block. Is it default behavior?

Thank you.

Janto

Re: ips 4255 interface pair

bbaley — Fri, 21 Oct 2005 17:09:20 GMT

On appliances, the sensing interfaces are disabled by default. On modules, the sensing interfaces are always enabled and cannot be disabled. The sensing interface does not have an IP address assigned to it and is therefore invisible to attackers. This lets the sensor monitor the data stream without letting attackers know they are being watched.

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_configuration_guide_chapter09186a0080459225.html

Re: ips 4255 interface pair

a.kiprawih — Tue, 25 Oct 2005 08:06:30 GMT

Hi Janto,

One of the action you can take is to put the public IP used by your customer to go out to the Internet under excluded IP that IDS will never block.

Some signatures by default are set to perform blocking action when it sees 'attack'. This could be why the public IP was blocked as it matches criteria falls under those signatures, e.g spoofing.

Cheers!

Re: ips 4255 interface pair

jcin — Wed, 26 Oct 2005 00:34:14 GMT

Hi,

How to exclude my public IP addresses?

Is it by configuring the event action rules?

Thank you.

Janto