Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Dustin Ralich
08-18-2017
Stats
Member since
04-27-2010
85
Posts
91
Helpful
19
Solutions
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
01-04-2012
11:28 AM
01-04-2012
11:28 AM
FYI, I filed a defect for this behavior/problem (after some extensive testing/recreate work in my lab) about a month ago: CSCtw75750 (IOS IPS: Auto-update Unable to Load IPS Signature File from cisco.com) Aside from that defect, there are a multiple reasons why the feature can fail in this manner. Examples / known potential causes: The device does not have a valid DNS server(s) ('ip name-server') configured and is not able to resolve 'www.cisco.com' to a valid/correct IP address. The device does not have the necessary (unobstructed/unmodified) connectivity/access to reach cisco.com (DNS, HTTP, and HTTPS). The device does not have an appropriate/valid certificate chain/trustpoints for cisco.com configured. The device clock is not correct/accurate. The configured CCO Account credentials (Username/Password) are incorrect/invalid. The configured CCO Account has not accepted the latest version of the cryptography/export agreement on cisco.com. The configured CCO Account is not entitled (via an Active SMARTnet / IPS Services contract) to download IPS Signature Definition Update Packages. Last year when you were troubleshooting this issue you did check many/all of those items, but since so much time has passed since then, it would be worthwhile to check them all again to be sure they are not causes. After that, review the Release Note for the defect above... if your encounter of this behavior is caused by that defect, the workaround listed should work successfully. If that is the case, then this specific defect is the cause for you. If the workaround does not succeed, then one or more of the above items is a/the cause.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
09:33 AM
10-10-2011
09:33 AM
FYI, these questions should be addressed with the CSE assigned to your TAC Service Request where the RMA was arranged. I will take a shot at answering them, but when you are working an active TAC Service Request, you should engage with the CSE assigned for questions relating to the issue at hand. Do I need to power down my primary ASA Yes, the AIP-SSM sensor modules are not OIR (Online Insertion/Removal) capable. The ASA unit in which the sensor module is being replaced should be powered off before removing the faulty sensor module and before installing the replacement. if I do power down, would it cause any issue to production since I am on secondary right now. If the other ASA member of the failover pair is currently Active and its sensor module is Up, then powering down the Standby ASA unit should not impact traffic. I have read that the module won't retain or synch config between devices. how do i access the configuration of the IPS module so that I can put it into the new module? Correct, the sensor modules themselves do not inheritly synchronize or replicate their configurations (like the ASA units of the failover pair do). If you are able to access the faulty sensor module long enough to get a copy of the ' show config ' command output, you can input that same output into the replacement sensor module. Finally, note that the Unresponsive status can be caused by non-hardware issues. IPS 6.1(1)E3 (which is what you appear to be running) is extremely old and no longer directly supported. You should upgrade to a modern, supported release (7.0(6)E4 or 6.2(4)E4), both of which contain many fixes, some of which correct issues that otherwise could/would cause the module to become Unresponsive.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
08:27 AM
10-10-2011
08:27 AM
What version of software is running on this sensor? If you are able to SSH into the sensor (or session into it from the ASA CLI), you can issue a ' show version ' to determine this. If you are not able to SSH into it (or session into it from the ASA CLI), you can issue a ' show module ' from the ASA and the software version should be shown on the line for the sensor module. FYI, there was a defect way back in IPS 5.1 that matches this behavior: CSCsf20405
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
08:19 AM
10-10-2011
08:19 AM
i've only realised that my aip-ssm only reports on traffic which is passed through the firewall acl does anyone know if i can change the default behaviour of the asa to let the module see the all traffic hitting the external interface? The architecture is such that only traffic that is allowed through the ASA is passed to the AIP-SSM/AIP-SSC for inspection. The idea being that there is no reason to tie up more resources inspecting traffic that has already been dropped/denied. my requirement is that i log all attempted intrusions regardless of whether they are permitted through the firewall or not If the ASA itself is dropping traffic, a syslog message should be generated/logged. Between the ASA logs and the sensor module logs, you should have what you need.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
08:11 AM
10-10-2011
08:11 AM
RDEP was deprecated back in IPS 6.1 (circa April 2008). It was removed in IPS 7.0 ("We deprecated the RDEP event server service in IPS 6.1 and we removed it in IPS 7.0(1) . We added the SDEE event server service to IPS 5.0 as a replacement for the RDEP event server service. We supported both the SDEE event server and RDEP event server through IPS 5.0, 5.1, 6.0, and 6.1 to allow time for monitoring tools to transition to using the SDEE event server for retrieval of events. With IPS 7.0(1), monitoring tools must use the SDEE event server service for the retrieval of events.") per: IPS 7.0(1) Release Notes
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
08:03 AM
10-10-2011
08:03 AM
In most cases I have encountered exhibiting this behavior, IME is being affected (denied/blocked/conflicting/stopped/etc.) by a HIPS software product installed on the system. If you are able to identify such a product, then try temporarily disabling/removing it and testing again. Some antivirus products can cause this type of behavior as well (including some level of basic HIPS functionality), so you may find that to be the culprit. If you are unable to identify the cause, test on a clean OS install (not an existing pre-made image or IT-created image that includes modifications/domain membership/packages/etc.); a completely clean OS install with IME 7.1.1.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
07:57 AM
10-10-2011
07:57 AM
I am wondering when IPS detected a potential threat is the sensor taking actions according Policies defined under the Event Action Override policy or the Event Action which is defined under the signatures? (Configuration > Policies > Signature Definitions > Sig0 > *) The Action(s) configured for the Signature that fired/triggered is "queued" to take effect. If an EAO (Event Action Override) matches, then the Action(s) configured for it is added to the queue. Then, if an EAF (Event Action Filter) matches, the Action(s) configured for it is subtracted from the queue. Whatever Action(s) remains (if any) then occurs. References : -SEAP (Signature Event Action Processor)
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-27-2011
08:22 AM
09-27-2011
08:22 AM
I'm trying to track down what I believe is a false positive for Rustock Botnet sig 17363-3. This is a "service HTTP" signature and it indicates "yes" on specify URI regex, specify header regex and specify request regex, but the regex field is blank (null?) for all three of these. What does this mean? Does it mean the signature is matched if these three fields are null in the evaluated packet? SIG 17363.3 is a "protected" signature; as a result, certain parameter values are not visible. Protected signatures may exist for a variety of reasons (e.g. NDA with relevant vendor, situations where detection method disclosure could enable evasion methods to be developed, etc.). You can confirm this is true for this signature by reviewing it via the sensor CLI (notice the "protected" values): sensor# conf t sensor(config)# service signature-definition sig0 sensor(config-sig)# signature 17363 3 sensor(config-sig-sig)# show settings uri-regex: ******** In this scenario, if you believe the signature is in-fact firing falsely, then you will need to open a TAC Service Request and provide copies of relevant Alerts (events), packet captures, etc. that can be analyzed by the IPS Signature Development Team.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-07-2011
07:21 AM
09-07-2011
07:21 AM
Does anyone know of where to find the config file on the CF card? Hi Ronald. This is not Cisco-supported, but the files you would be most interested in would probably be: /usr/cids/idsRoot/etc/current.cfg /usr/cids/idsRoot/etc/backup.cfg Best practices of course would be to have up-to-date backups stored somewhere safe incase of failure . Moving forward, I would like to know the file is so that when we return the equipment to the leasing company at the end of the lease so I would prefer not to have this info still on the SSM module when it goes back. Your best bet for that would be to re-image the sensor module before returning the gear.
... View more
Created by
Dustin Ralich
in Other Security Subjects
in Other Security Subjects
09-06-2011
11:30 AM
09-06-2011
11:30 AM
Inspection Rules themselves do not have a Severity (color) ... the Severity specification for each offset of an Inspection Rule is used to govern what matches the offset (i.e. if set to "RED", only RED Events can match that particular offset). This is more apparent with multi-offset Rules (where one offset's Severity is RED, another is YELLOW, etc., all under a single Inspection Rule). When an Inspection Rule fires (is triggered), the highest Severity of all the Events that contributed to it firing is used for the resultant Incident that is generated. Again, the Inspection Rules themselves do not have a Severity. If you want to view only RED Incidents, you can filter from the MARS GUI > INCIDENTS page by changing the "All Severities" drop-down selector. If you want to see all Inspection Rules that have an offset that specifically matches on RED events, then from the MARS GUI > RULES > Inspection Rules page, change the "25 per page" drop-down selector to a large enough value to display all your Rules on one page, then use your web browser's Find feature (usually F) and search for "RED", "YELLOW", "GREEN", etc. This may of course match on other words that include RED ("credit" for example), but is the closest option for what you are looking for.
... View more
09-06-2011
11:18 AM
Hi James. When I try to re-image my MARS 20 appliance with the recovery ISO downloaded from the CCO and I burn the ISO as it says when booting from the DVD it gets to the menu to select how I want to re-image and it locks up. Has anyone ever seen this and how did you fix it. I have had 3 different appliances and they all do the same thing. You are connected via the appliance's Direct Console (VGA + PS/2 keyboard), right? If you are using a USB keyboard, try a PS/2 keyboard instead. Also, if this is a CS-MARS 20 model, make sure you are selecting option '1. Distributed Mars - Local Controller', not option #3 (that option only applies to the generation 2 hardware models). If neither of the above is the cause, then it sounds like a problem with the burnt disc. Verify the MD5 checksum of your local copy of the .ISO image file matches what is shown on cisco.com. Re-burn the ISO image to a new disc, force a "slow" burn speed (4x or less), try another brand of media as well (I have run into a few cases where when other media brands were used, these types of issues went away).
... View more
Created by
Dustin Ralich
in Other Security Subjects
in Other Security Subjects
09-06-2011
11:08 AM
09-06-2011
11:08 AM
If we receive this message from MARS, regarding RAID BBU, and "show healthinfo" shows that battery is ok (Relative state of charge : 93 %), is it necessary to replace this battery anyway? In regards to replacing the RAID BBU, the relevant part of the ' show healthinfo ' command output is not the Relative state of charge (%), it is the Full charge capacity value. A new RAID BBU will have a capacity somewhere between (approximately) 1,000 - 1,500 mAh. If you are receiving the automated Alert Notifications indicating your RAID BBU requires replacement, your ' show healthinfo ' command output's Full charge capacity value is probably down in the 500 - 650 mAh range, indicating that yes, it needs to be replaced.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-06-2011
07:50 AM
09-06-2011
07:50 AM
Hi Mike. Looks like you resolved this before a response was posted . FYI (and for good documentation incase anyone else is experiencing this same issue and finds this discussion), this is well-documented here.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-06-2011
07:45 AM
09-06-2011
07:45 AM
Hello Alvaro. I have configured the IPS in inline mode with policy action sg0 with log all permit (packet, atack, victim). If you mean you have configured an EAO (Event Action Override) set to add the Log Attacker Packets, Log Victim Packets, and Log Pair Packets Actions: This will almost certainly result in your sensor becoming oversubscribed, unresponsive, etc. Please review the section of this document regarding this. I want to see in the IME 7.1, but I can not see this events. How i can configure the IME to i see this events You can download copies of the IP Log file(s) present on the sensor from within IME from the Configuration tab > Sensor Monitoring > Time-Based Actions > IP Logging section. Each IP Log file has an associated "Alert ID" that corresponds with the event/Alert that generated it. The Alerts themselves can be reviewed via IME's Event Monitoring tab.
... View more
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
08-31-2011
11:30 AM
08-31-2011
11:30 AM
Are you sure this is on an IOS IPS device (i.e. setup in the IOS software itself on a router) or is it an actual sensor device (AIM-IPS sensor module, NME-IPS sensor module, 4200-series sensor appliance, etc.)? Can you post a copy (or readable screenshot) of the relevant portions of your config? On IPS devices, if you invoke a Deny Attacker Action, it will remain in effect for 1 hour (by-default). Likewise, Request Block Actions remain in effect for 30 minutes (by-default). So, if such an Action was triggered, even if future traffic from the same host did not match your modified EAO, the Action(s) would still be in-place for the duration of the timer(s). In that regard, on IPS devices, you can view the current Denied Attackers list via the ' show statistics denied-attackers ' command and the Blocked Hosts list via the ' show statistics network-access ' command.
... View more
01-04-2012
FYI, I filed a defect for this behavior/problem (after some extensive
testing/recreate work in my la...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
10-10-2011
FYI, these questions should be addressed with the CSE assigned to your
TAC Service Request where the...
10-10-2011
What version of software is running on this sensor? If you are able to
SSH into the sensor (or sessi...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
10-10-2011
i've only realised that my aip-ssm only reports on traffic which is
passed through the firewall acld...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-10-2011
10-10-2011
RDEP was deprecated back in IPS 6.1 (circa April 2008). It was removed
in IPS 7.0 ("We deprecated th...
10-10-2011
In most cases I have encountered exhibiting this behavior, IME is being
affected (denied/blocked/con...
10-10-2011
I am wondering when IPS detected a potential threat is the sensor taking
actions according Policies ...
09-27-2011
I'm trying to track down what I believe is a false positive for Rustock
Botnet sig 17363-3. This is ...
09-07-2011
Does anyone know of where to find the config file on the CF card?Hi
Ronald. This is not Cisco-suppor...
Created by
Dustin Ralich
in Other Security Subjects
09-06-2011
09-06-2011
Inspection Rules themselves do not have a Severity (color)... the
Severity specification for each of...
09-06-2011
Hi James.When I try to re-image my MARS 20 appliance with the recovery
ISO downloaded from the CCO a...
Created by
Dustin Ralich
in Other Security Subjects
09-06-2011
09-06-2011
If we receive this message from MARS, regarding RAID BBU, and "show
healthinfo" shows that battery i...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-06-2011
09-06-2011
Hi Mike. Looks like you resolved this before a response was posted . FYI
(and for good documentation...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
09-06-2011
09-06-2011
Hello Alvaro.I have configured the IPS in inline mode with policy action
sg0 with log all permit (pa...
Created by
Dustin Ralich
in Intrusion Prevention and Detection Systems (IPS - IDS)
08-31-2011
08-31-2011
Are you sure this is on an IOS IPS device (i.e. setup in the IOS
software itself on a router) or is ...
Public Statistics
| Date Registered | 04-27-2010 12:34 PM |
| Date Last Visited | 08-18-2017 04:01 AM |
| Total Messages Posted | 85 |
| Total Helpful Votes Received | 91 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 27 | |
| 23 | |
| 25 | |
| 11 | |
| 4 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 5 | |
| 5 | |
| 3 | |
| 5 |
