| 12.4 |  | Intrusion Detection |
| 12.4.1 |  | Overview of intrusion detection and the PIX Security Appliance |

| Intrusion detection is the ability to detect attacks against a network. This section will introduce students to the PIX IDS, its capabilities, and how to enable it on the PIX. PIX Security Appliance software versions 5.2 and higher have Cisco IDS capabilities. Intrusion detection is the ability to detect attacks against reconnaissance, access, and DoS attacks.

The CiscoSecure IDS for the PIX Security Appliance is an IP-only feature that provides the flexibility for the PIX administrator to customize the type of traffic that should be audited, logged, and/or dropped. The PIX performs this process by looking at IP packets as they arrive at an input interface and determining if the packet matches a predefined signature. If it does, the packet triggers a signature and a configured action takes place.

It is important to recognize that the IDS feature of the PIX is very limited in its scope and is not meant to serve as a replacement for dedicated network or host-based sensors. Overall, the PIX IDS does play an important role in augmenting the overall intrusion detection capabilities of a network.