| 5.1 |  | IOS Firewall IDS |
| 5.1.1 |  | Introduction |

| One of the primary concepts of the Security Wheel is monitoring. Deploying security devices without checking the status of these devices cannot secure a network. Network security is a constant cycle of securing, monitoring, testing, and improving, centered on a security policy. A network manager must be prepared to monitor the network against attacks, failures, and other important events. IDS, syslog, and SNMP are some of the tools available for securing a network.

A router-based IDS image includes over 100 of the most common attack signatures. The intrusion detection signatures included in the new release of the Cisco IOS Firewall IDS were chosen from a broad cross section of intrusion detection signatures. These signatures are representative of the most common network attacks and information gathering scans that are not commonly found in an operational network.

Since the router is being used as a security device, no packet will be allowed to bypass the security mechanisms. The IDS process in the Cisco IOS Firewall router sits directly in the packet path and will search each packet for signature matches. In some cases, the entire packet will need to be searched. The router must maintain state information and even application state and awareness.

The Cisco IOS Firewall IDS provides firewall and intrusion detection capabilities to a variety of Cisco IOS routers. It acts like a sensor in a Cisco Secure IDS. It can be added to the Cisco Secure IDS Director map as another icon to provide a consistent view of all intrusion detection sensors throughout a network. The Cisco IOS Firewall IDS contains an enhanced reporting mechanism that permits logging to the router syslog service in addition to the Cisco Secure IDS Director.

The Cisco IOS Firewall IDS provides a level of protection beyond the firewall by protecting the network from internal and external attacks and threats. This technology enhances perimeter firewall protection by taking appropriate action on packets and flows that violate the security policy or represent malicious network activity.

The Cisco IOS Firewall with intrusion detection is useful for network perimeter protection. It is especially useful for locations from which a router is deployed, and which require additional security between network segments, and between an organization and a less trusted partner site. The Cisco IOS software-based intrusion detection capabilities complement a full Cisco Secure IDS because they provide additional visibility into the network on Cisco IOS software-based devices and communicate with the Cisco Secure IDS Director security management system.

The Cisco IOS Firewall IDS capabilities are ideal for providing additional visibility at intranet, extranet, and branch-office Internet perimeters . The Cisco IOS Firewall IDS can automatically respond to threats from internal or external hosts. IDS signatures can be deployed alongside or independently of other features.

If a more extensive IDS solution is required, the dedicated 4200 series appliances are equipped with over 900 signatures and scale to gigabit line speed. Similarly, the Cisco IDS Network Module for the Cisco 2600, 3600, and 3700 series routers provides the same level of signature protection as the appliances but only scales to 45 Mbps . The IDS module can be configured and monitored via the Cisco IDS Management Console which is part of CiscoWorks VPN/Security Management Solution, and Cisco IDS Device Manager. The software-based IOS intrusion detection provides small and medium businesses an alternative to more complex IDS deployment solutions such as those shown in Figure . A network administrator has options to choose a variety of solutions based on the desired level of protection, performance, and cost.

| Web Links IDS Sans- http://www.sans.org/resources/idfaq/ Ceria- http://www.cerias.purdue.edu/coast/ intrusion-detection/
Talisker- http://www.networkintrusion.co.uk/
index.htm

IDS Sensors:

Network Based
Cisco Products and Services- http://www.cisco.
com/en/US/products/hw/vpndevc/ps4077/index.html

Host Based
Cisco Products and Services- http://www.cisco.com/
en/US/ products/sw/secursw/ps5057/index.html

Cisco Intrusion Detection System (IDS) 4200 Sensors
http://www.cisco.com/en/US/products/hw/vpndevc/
ps4077/index.html

Cisco Catalyst 6500 Series Intrusion Detection System
(IDSM-2) Services Module http://www.cisco.com/en/US
/products/hw/modules/ps2706/ps5058/index.html