| 12.4 |  | Intrusion Detection |
| 12.4.3 |  | Intrusion detection in the PIX |

| Intrusion detection, or auditing, is enabled on the PIX Security Appliance with the ip audit commands. Using the ip audit commands, audit policies can be created to specify the traffic that is audited. Audit policies can designate actions to be taken when a signature is detected. After a policy is created, it can then be applied to any PIX Security Appliance interface using the ip audit interface command.

Each interface can have two policies. One is for informational signatures and the other is for attack signatures. When a policy for a given signature class is created and applied to an interface, all supported signatures of that class are monitored unless they are disabled with the ip audit signature disable command.

The PIX Security Appliance supports both inbound and outbound auditing. It performs the auditing process by looking at each of the IP packets as they arrive at an input interface. For example, if an attack policy is applied to the outside interface, attack signatures are triggered when traffic matching those signatures arrives at the outside interface in an inward direction. This could be either inbound traffic or return traffic from an outbound connection.

The corresponding demonstration activity will show students how to configure Intrusion Detection.

The online command reference will examine how to enable the PIX Security Appliance to support IDS.

| Lab Activity Lab Exercise: Configure Intrusion Detection In this lab exercise, students will configure the use of Cisco Intrusion Detection System (IDS) information signatures and send Cisco IDS Syslog output to a Syslog server. Students will also configure the use of IDS attack signatures and send Cisco IDS Syslog output to a Syslog server.

| Media Activity Demonstration Activity: Intrusion Detection Process in the PIX Security Appliance In this activity, students will learn the intrusion detection process in the PIX Security Appliance.