| Overview

The Security Wheel not only requires the application of security measures on the network, but most importantly, it provides a continual process for monitoring, testing and improving security measures. The security policy is the centerpiece of the Security Wheel. One method to assist administrators with this cycle is the proper implementation and configuration of the Cisco IOS Firewall Intrusion Detection System (IDS).

The current Cisco IOS Firewall IDS will monitor and detect 100 of the most common attacks using signatures to detect patterns of misuse in network traffic. The IDS can automatically reset, drop, or alert an administrator about a suspicious packet. Additionally, IDS provides the capability to configure, disable, and exclude signatures.

After discussing setup and configuration procedures for the firewall IDS, the student will learn about monitoring the network through logging and syslog. Logs can show what type of probes or attacks are being attempted against the router or the protected network. The administrator can use the logs to further enhance and secure the network. The syslog protocol provides a transport to allow a machine to send event notification messages across IP networks.

Finally, the student will also learn about the Simple Network Management Protocol (SNMP). SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. SNMP is often used to gather statistics and remotely monitor network infrastructure devices. It is a very simplistic protocol and therefore has virtually no security built into its original version. However, when used properly, the information gathering attributes of SNMP can effectively assist the administrator with security.

NOTE: It is required that the student study the commands covered in the chapter using the labs and the command reference. Not all required commands are covered in sufficient detail in the text alone. Successful completion of this course requires a thorough knowledge of command syntax and application.