Hello,
I have a 2821 router running IOS IPS in the 4.x signature format. 2821 IOS is 12.4(13)c
SDEE is configured on the router.
ip ips sdf location flash:256MB.sdf
ip ips notify SDEE
no ip ips notify log
ip ips signature 4620 0 disable
ip ips name IDS
ip sdee subscriptions 3
ip sdee alerts 1000
interface GigabitEthernet0/0.111
...
ip ips IDS in
ip ips IDS out
MARS is running 4.3.1
The router is configured in MARS and the IPS Option is configured as well. It discovers fine and is Activated.
I then light up across the router with an agressive NESSUS scan. The router reports lots of events:
RA-2821-1#sho ip sdee alerts
Alert storage: 1000 alerts using 272000 bytes of memory
SDEE Alerts
SigID Sig Name SrcIP:SrcPort DstIP:DstPort
or Summary Info
1: 3201:1 Unix Password File Acces 10.111.90.161:54965 10.111.101.27:80
2: 3201:1 Unix Password File Acces 10.111.90.161:55291 10.111.101.27:80
3: 3201:1 Unix Password File Acces 10.111.90.161:55291 10.111.101.27:80
4: 3201:1 Unix Password File Acces 10.111.90.161:55291 10.111.101.27:80
5: 5170:0 Null Byte In HTTP Reques 10.111.90.161:55338 10.111.101.27:80
6: 5170:0 Null Byte In HTTP Reques 10.111.90.161:55338 10.111.101.27:80
7: 5170:0 Null Byte In HTTP Reques 10.111.90.161:55338 10.111.101.27:80
8: 3201:1 Unix Password File Acces 10.111.90.161:55369 10.111.101.27:80
9: 3201:1 Unix Password File Acces 10.111.90.161:55369 10.111.101.27:80
10: 3201:1 Unix Password File Acces 10.111.90.161:55369 10.111.101.27:80
11: 5445:0 AWStats configdir Comman 10.111.90.161:55440 10.111.101.27:80
12: 5445:0 AWStats configdir Comman 10.111.90.161:55440 10.111.101.27:80
etc...
In MARS, I get the events, except they are classified as "Generic Syslog Events"
Drilling in, I get the raw message as "NR-5114/0 "
Note the space after the zero.
By the way, an AIP-10 reports correctly.
How do I get the IOS IPS to report correctly to MARS?
Ward
