Cisco 4215 - Intrusion Detection Sys Sensor User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Intrusion Prevention System Sensor
CLI Configuration Guide for IPS 5.0
Customer Order Number: DOC-7816527=
Text Part Number: 78-16527-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Copyright © 2005-2010 Cisco Systems, Inc. All rights reserved.

iii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
CONTENTS
Preface xvii
Contents i-xvii
Audience i-xvii
Conventions i-xvii
Related Documentation i-xviii
Obtaining Documentation and Submitting a Service Request i-xix
CHAPTER 1Introducing the CLI Configuration Guide 1-1
Overview 1-1
Sensor Configuration Task Flow 1-2
User Roles 1-3
CLI Behavior 1-4
Command Line Editing 1-5
IPS Command Modes 1-6
Regular Expression Syntax 1-7
General CLI Commands 1-9
CLI Keywords 1-9
CHAPTER 2Logging In to the Sensor 2-1
Overview 2-1
Supported User Roles 2-1
Logging In to the Appliance 2-2
Setting Up a Terminal Server 2-3
Logging In to IDSM-2 2-4
Logging In to NM-CIDS 2-5
Logging In to AIP-SSM 2-7
Logging In to the Sensor 2-8
CHAPTER 3Initializing the Sensor 3-1
Overview 3-1
System Configuration Dialog 3-1
Initializing the Sensor 3-2

Contents
iv
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Verifying Initialization 3-7
CHAPTER 4Initial Configuration Tasks 4-1
Changing Network Settings 4-1
Changing the Hostname 4-2
Changing the IP Address, Netmask, and Gateway 4-3
Enabling and Disabling Telnet 4-4
Changing the Access List 4-5
Changing the FTP Timeout 4-7
Adding a Login Banner 4-8
Changing Web Server Settings 4-9
Configuring User Parameters 4-11
Adding and Removing Users 4-11
Password Recovery 4-13
Creating the Service Account 4-13
Configuring Passwords 4-14
Changing User Privilege Levels 4-15
Viewing User Status 4-16
Configuring Account Locking 4-17
Configuring Time 4-18
Time Sources and the Sensor 4-18
Correcting Time on the Sensor 4-20
Configuring Time on the Sensor 4-21
System Clock 4-21
Configuring Summertime Settings 4-22
Configuring Timezones Settings 4-27
Configuring NTP 4-27
Configuring a Cisco Router to be an NTP Server 4-28
Configuring the Sensor to Use an NTP Time Source 4-29
Configuring SSH 4-30
About SSH 4-30
Adding Hosts to the Known Hosts List 4-31
Adding SSH Authorized Public Keys 4-32
Generating a New SSH Server Key 4-34
Configuring TLS 4-34
About TLS 4-34
Adding TLS Trusted Hosts 4-35
Displaying and Generating the Server Certificate 4-37
Installing the License Key 4-37

Contents
v
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
CHAPTER 5Configuring Interfaces 5-1
Understanding Interfaces 5-1
Interface Support 5-2
Promiscuous Mode 5-4
Understanding Promiscuous Mode 5-4
Understanding TCP Reset 5-4
Configuring Promiscuous Mode 5-4
Inline Mode 5-7
Understanding Inline Mode 5-7
Configuring Inline Mode 5-7
Assigning Interfaces to the Virtual Sensor 5-8
Bypass Mode 5-9
Understanding Bypass Mode 5-9
Configuring Bypass Mode 5-10
Configuring Interface Notifications 5-10
CHAPTER 6Configuring Event Action Rules 6-1
About Event Action Rules 6-1
Signature Event Action Processor 6-2
Event Actions 6-3
Task List for Configuring Event Action Rules 6-4
Event Action Variables 6-4
About Event Action Variables 6-5
Configuring Event Action Variables 6-5
Calculating the Risk Rating 6-6
Configuring Target Value Ratings 6-7
Event Action Overrides 6-7
About Event Action Overrides 6-7
Configuring Event Action Overrides 6-8
Event Action Filters 6-9
About Event Action Filters 6-9
Configuring Event Action Filters 6-10
General Settings 6-14
About General Settings 6-15
Event Action Summarization 6-15
Event Action Aggregation 6-15
Deny Attackers 6-16

Contents
vi
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Configuring the General Settings 6-16
Clearing the Denied Attackers List 6-18
Event Action Rules Example 6-19
CHAPTER 7Defining Signatures 7-1
About Signatures 7-1
Signature Variables 7-2
About Signature Variables 7-2
Configuring Signature Variables 7-2
Configuring Signatures 7-3
Configuring General Signature Parameters 7-4
Configuring Alert Frequency 7-5
Configuring Alert Severity 7-6
Configuring Event Counter 7-8
Configuring Signature Fidelity Rating 7-9
Configuring the Status of Signatures 7-10
Assigning Actions to Signatures 7-11
Configuring AIC Signatures 7-12
Overview 7-12
Configuring the Application Policy 7-13
AIC Request Method Signatures 7-15
AIC MIME Define Content Type Signatures 7-16
AIC Transfer Encoding Signatures 7-19
AIC FTP Commands Signatures 7-20
IP Fragment Reassembly 7-22
Overview 7-22
Configuring IP Fragment Reassembly Parameters 7-22
Configuring the Method for IP Fragment Reassembly 7-23
Configuring TCP Stream Reassembly 7-24
Overview 7-24
Configuring TCP Stream Reassembly Parameters 7-24
Configuring the Mode for TCP Stream Reassembly 7-27
Configuring IP Logging 7-28
Creating Custom Signatures 7-29
Sequence for Creating a Custom Signature 7-29
Example STRING.TCP Signature 7-30
Example SERVICE.HTTP Signature 7-32
Example MEG Signature 7-33
Example AIC MIME-Type Signature 7-36

Contents
vii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
CHAPTER 8Configuring IP Logging 8-1
About IP Logging 8-1
Configuring Automatic IP Logging 8-2
Configuring Manual IP Logging for a Specific IP Address 8-3
Stopping Active IP Logs 8-4
Copying IP Log Files to Be Viewed 8-6
CHAPTER 9Displaying and Capturing Live Traffic on an Interface 9-1
About Packet Display and Capture 9-1
Displaying Live Traffic on an Interface 9-2
Capturing Live Traffic on an Interface 9-4
Copying the Packet File 9-6
Erasing the Packet File 9-7
CHAPTER 10 Configuring Blocking 10-1
Understanding Blocking 10-1
Blocking Prerequisites 10-3
Supported Blocking Devices 10-3
Configuring Blocking Properties 10-4
Allowing the Sensor to Block Itself 10-4
Disabling Blocking 10-6
Setting Maximum Block Entries 10-8
Setting the Block Time 10-10
Enabling ACL Logging 10-11
Enabling Writing to NVRAM 10-12
Logging All Blocking Events and Errors 10-13
Configuring the Maximum Number of Blocking Interfaces 10-14
Configuring Addresses Never to Block 10-15
Configuring User Profiles 10-17
Configuring Blocking Devices 10-18
How the Sensor Manages Devices 10-18
Configuring the Sensor to Manage Cisco Routers 10-19
Routers and ACLs 10-19
Configuring the Sensor to Manage Cisco Routers 10-20
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series
Routers 10-21
Switches and VACLs 10-21

Contents
viii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series
Routers 10-22
Configuring the Sensor to Manage Cisco Firewalls 10-24
Configuring the Sensor to be a Master Blocking Sensor 10-25
Configuring Manual Blocking 10-27
Obtaining a List of Blocked Hosts and Connections 10-28
CHAPTER 11 Configuring SNMP 11-1
About SNMP 11-1
Configuring SNMP 11-2
Configuring SNMP Traps 11-4
Supported MIBS 11-6
CHAPTER 12 Working With Configuration Files 12-1
Displaying the Current Configuration 12-1
Displaying the Current Submode Configuration 12-3
Filtering the Current Configuration Output 12-9
Filtering the Current Submode Configuration Output 12-11
Displaying the Contents of a Logical File 12-13
Copying and Restoring the Configuration File Using a Remote Server 12-15
Creating and Using a Backup Configuration File 12-17
Erasing the Configuration File 12-17
CHAPTER 13 Administrative Tasks for the Sensor 13-1
Creating a Banner Login 13-1
Terminating CLI Sessions 13-2
Modifying Terminal Properties 13-3
Events 13-4
Displaying Events 13-4
Clearing Events from the Event Store 13-7
System Clock 13-7
Displaying the System Clock 13-7
Manually Setting the Clock 13-8
Clearing the Denied Attackers List 13-8
Displaying Statistics 13-10
Displaying Tech Support Information 13-18
Displaying Version Information 13-19

Contents
ix
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Directing Output to a Serial Connection 13-21
Diagnosing Network Connectivity 13-22
Resetting the Appliance 13-23
Displaying Command History 13-24
Displaying Hardware Inventory 13-24
Tracing the Route of an IP Packet 13-25
Displaying Submode Settings 13-26
CHAPTER 14 Configuring AIP-SSM 14-1
Configuration Sequence 14-1
Verifying AIP-SSM Initialization 14-2
Sending Traffic to AIP-SSM 14-2
Overview 14-2
Configuring ASA to Send IPS Traffic to AIP-SSM 14-3
Reloading, Shutting Down, Resetting, and Recovering AIP-SSM 14-5
CHAPTER 15 Configuring IDSM-2 15-1
Configuration Sequence 15-1
Verifying IDSM-2 Installation 15-2
Configuring the Catalyst 6500 Series Switch for Command and Control Access to IDSM-2 15-4
Catalyst Software 15-4
Cisco IOS Software 15-6
Configuring the Catalyst Series 6500 Switch for IDSM-2 in Promiscuous Mode 15-7
Using the TCP Reset Interface 15-7
Configuring SPAN 15-8
Catalyst Software 15-8
Cisco IOS Software 15-10
Configuring VACLS 15-11
Catalyst Software 15-12
Cisco IOS Software 15-13
Configuring the mls ip ids Command 15-14
Catalyst Software 15-15
Cisco IOS Software 15-15
Configuring the Catalyst Series 6500 Switch for IDSM-2 in Inline Mode 15-16
Catalyst Software 15-17
Cisco IOS Software 15-18
Configuring EtherChanneling 15-20
Overview 15-20

Contents
x
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Enabling EtherChanneling 15-20
Disabling EtherChanneling 15-22
Verifying EtherChanneling 15-23
Administrative Tasks for IDSM-2 15-24
Enabling Full Memory Tests 15-24
Catalyst Software 15-24
Cisco IOS Software 15-25
Resetting IDSM-2 15-26
Catalyst Software 15-26
Cisco IOS Software 15-27
Catalyst and Cisco IOS Software Commands 15-27
Catalyst Software 15-27
Supported Supervisor Engine Commands 15-28
Unsupported Supervisor Engine Commands 15-29
Cisco IOS Software 15-29
EXEC Commands 15-30
Configuration Commands 15-31
CHAPTER 16 Configuring NM-CIDS 16-1
Configuration Sequence 16-1
Configuring IDS-Sensor Interfaces on the Router 16-2
Establishing NM-CIDS Sessions 16-3
Sessioning to NM-CIDS 16-4
Telneting to NM-CIDS 16-5
Configuring Packet Capture 16-5
Administrative Tasks for NM-CIDS 16-7
Shutting Down, Reloading, and Resetting NM-CIDS 16-7
Checking the Status of the Cisco IPS Software 16-7
Supported Cisco IOS Commands 16-8
CHAPTER 17 Upgrading, Downgrading, and Installing System Images 17-1
Overview 17-1
Upgrading the Sensor 17-2
Overview 17-2
Upgrade Command and Options 17-2
Using the Upgrade Command 17-3
Upgrading the Recovery Partition 17-4
Configuring Automatic Upgrades 17-5

Contents
xi
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Overview 17-5
UNIX-Style Directory Listings 17-5
Auto-upgrade Command and Options 17-6
Using the auto-upgrade Command 17-7
Downgrading the Sensor 17-8
Recovering the Application Partition 17-9
Overview 17-9
Using the Recover Command 17-9
Installing System Images 17-10
Overview 17-11
Installing the IDS-4215 System Image 17-11
Upgrading the IDS-4215 BIOS and ROMMON 17-13
Installing the IPS-4240 and IPS-4255 System Image 17-15
Using the Recovery/Upgrade CD 17-18
Installing the NM-CIDS System Image 17-19
Overview 17-19
Installing the NM-CIDS System Image 17-20
Upgrading the Bootloader 17-22
Installing the IDSM-2 System Image 17-25
Installing the System Image 17-25
Configuring the Maintenance Partition 17-27
Upgrading the Maintenance Partition 17-35
Installing the AIP-SSM System Image 17-36
CHAPTER 18 Obtaining Software 18-1
Obtaining Cisco IPS Software 18-1
IPS Software Image Naming Conventions 18-2
5.x Software Release Examples 18-4
Upgrading Cisco IPS Software to 5.0 18-5
Obtaining a License Key From Cisco.com 18-6
Overview 18-6
Service Programs for IPS Products 18-7
Installing the License Key 18-8
Using IDM 18-8
Using the CLI 18-9
Cisco Security Center 18-11
Cisco IPS Active Update Bulletins 18-11
Accessing IPS Documentation 18-12

Contents
xii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
APPENDIX ASystem Architecture A-1
System Overview A-1
System Design A-1
IPS 5.0 New Features A-3
User Interaction A-4
Security Features A-5
MainApp A-5
MainApp Responsibilities A-6
Event Store A-7
About Event Store A-7
Event Data Structures A-8
IPS Events A-8
NotificationApp A-9
CtlTransSource A-11
Network Access Controller A-12
About Network Access Controller A-12
Network Access Controller Features A-13
Supported Blocking Devices A-15
ACLs and VACLs A-16
Maintaining State Across Restarts A-16
Connection-Based and Unconditional Blocking A-17
Blocking with Cisco Firewalls A-18
Blocking with Catalyst Switches A-19
LogApp A-19
AuthenticationApp A-20
AuthenticationApp Responsibilities A-20
Authenticating Users A-20
Configuring Authentication on the Sensor A-21
Managing TLS and SSH Trust Relationships A-21
Web Server A-22
SensorApp A-22
Responsibilities and Components A-23
Packet Flow A-24
SEAP A-25
New Features A-26
CLI A-28
User Roles A-28
Service Account A-29
CLI Behavior A-30

Contents
xiii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Communications A-31
IDAPI A-31
RDEP2 A-32
IDIOM A-34
IDCONF A-34
SDEE A-35
CIDEE A-35
IPS 5.0 File Structure A-36
Summary of IPS 5.0 Applications A-37
APPENDIX BSignature Engines B-1
About Signature Engines B-1
MASTER Engine B-3
General Parameters B-3
Alert Frequency B-4
Event Actions B-5
AIC Engine B-6
Overview B-6
AIC Engine Parameters B-7
ATOMIC Engine B-8
ATOMIC.ARP Engine B-8
ATOMIC.IP Engine B-9
FLOOD Engine B-10
META Engine B-10
NORMALIZER Engine B-11
Overview B-12
NORMALIZER Engine Parameters B-12
SERVICE Engines B-13
SERVICE.DNS Engine B-14
SERVICE.FTP Engine B-15
SERVICE.GENERIC Engine B-16
SERVICE.H225 Engine B-16
Overview B-17
SERVICE.H255 Engine Parameters B-17
SERVICE.HTTP Engine B-19
Overview B-19
SERVICE.HTTP Engine Parameters B-19
SERVICE.IDENT Engine B-20

Contents
xiv
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
SERVICE.MSRPC Engine B-21
Overview B-21
SERVICE.MSRPC Engine Parameters B-21
SERVICE.MSSQL Engine B-22
SERVICE.NTP Engine B-22
SERVICE.RPC Engine B-23
SERVICE SMB Engine B-24
SERVICE.SNMP Engine B-26
SERVICE.SSH Engine B-27
STATE Engine B-27
STRING Engines B-29
Overview B-29
STRING.ICMP Engine Parameters B-29
STRING.TPC Engine Parameters B-30
STRING-UDP Engine Parameters B-31
SWEEP Engine B-31
TRAFFIC ICMP Engine B-33
TROJAN Engines B-34
APPENDIX CTroubleshooting C-1
Preventive Maintenance C-1
Disaster Recovery C-2
Password Recovery C-3
Troubleshooting the 4200 Series Appliance C-3
Communication Problems C-4
Cannot Access the Sensor CLI Through Telnet or SSH C-4
Misconfigured Access List C-6
Duplicate IP Address Shuts Interface Down C-7
SensorApp and Alerting C-8
SensorApp Not Running C-8
Physical Connectivity, SPAN, or VACL Port Issue C-10
Unable to See Alerts C-11
Sensor Not Seeing Packets C-13
Cleaning Up a Corrupted SensorApp Configuration C-14
Bad Memory on IDS-4250-XL C-15
Blocking C-15
Troubleshooting Blocking C-15
Verifying Network Access Controller is Running C-16
Verifying Network Access Controller Connections are Active C-17

Contents
xv
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Device Access Issues C-18
Verifying the Interfaces and Directions on the Network Device C-19
Enabling SSH Connections to the Network Device C-20
Blocking Not Occurring for a Signature C-21
Verifying the Master Blocking Sensor Configuration C-22
Logging C-23
Enabling Debug Logging C-23
Zone Names C-27
Directing cidLog Messages to SysLog C-28
Verifying the Sensor is Synchronized with the NTP Server C-29
TCP Reset Not Occurring for a Signature C-29
Software Upgrades C-31
IDS-4235 and IDS-4250 Hang During A Software Upgrade C-31
Which Updates to Apply and Their Prerequisites C-31
Issues With Automatic Update C-32
Updating a Sensor with the Update Stored on the Sensor C-33
UNIX-Style Directory Listings C-34
Troubleshooting IDM C-34
Increasing the Memory Size of the Java Plug-In C-34
Java Plug-In on Windows C-35
Java Plug-In on Linux and Solaris C-35
Cannot Launch IDM - Loading Java Applet Failed C-36
Cannot Launch IDM -Analysis Engine Busy C-37
IDM, Remote Manager, or Sensing Interfaces Cannot Access the Sensor C-37
Signatures Not Producing Alerts C-38
Troubleshooting IDSM-2 C-38
Diagnosing IDSM-2 Problems C-39
Switch Commands for Troubleshooting C-39
Status LED Off C-40
Status LED On But IDSM-2 Does Not Come Online C-42
Cannot Communicate With IDSM-2 Command and Control Port C-42
Using the TCP Reset Interface C-44
Connecting a Serial Cable to IDSM-2 C-44
Troubleshooting AIP-SSM C-44
Gathering Information C-46
Tech Support Information C-47
Overview C-47
Displaying Tech Support Information C-47
Tech Support Command Output C-48

Contents
xvi
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Version Information C-50
Overview C-50
Displaying Version Information C-50
Statistics Information C-52
Overview C-52
Displaying Statistics C-53
Interfaces Information C-61
Overview C-61
Interfaces Command Output C-61
Events Information C-62
Sensor Events C-63
Overview C-63
Displaying Events C-63
Clearing Events C-66
cidDump Script C-66
Uploading and Accessing Files on the Cisco FTP Site C-67
G LOSSARY
I NDEX

xvii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Preface
Revised: October 19, 2011, 78-16527-01
Contents
This document describes how to configure the sensor using the IPS 5.0 CLI. It contains the following
topics:
•Audience, page xvii
•Conventions, page xvii
•Related Documentation, page xviii
•Obtaining Documentation and Submitting a Service Request, page xix
Audience
This guide is intended for administrators who need to do the following:
•Configure the sensor for intrusion prevention using the CLI.
•Secure their network with IPS sensors.
•Prevent intrusion on their networks and monitor subsequent alerts.
Conventions
This document uses the following conventions:
Convention Indication
bold font Commands and keywords and user-entered text appear in bold font.
italic font Document titles, new or emphasized terms, and arguments for which you supply
values are in italic font.
[ ] Elements in square brackets are optional.
{x | y | z } Required alternative keywords are grouped in braces and separated by
vertical bars.

xviii
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Preface
Related Documentation
Note Means reader take note.
Tip Means the following information will help you solve a problem.
Caution Means reader be careful. In this situation, you might perform an action that could result in equipment
damage or loss of data.
Timesaver Means the described action saves time. You can save time by performing the action described in
the paragraph.
Warning Means reader be warned. In this situation, you might perform an action that could result in
bodily injury.
Related Documentation
For more information on Cisco IPS, refer to the following documentation found at this URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/tsd_products_support_series_home.html
•Documentation Roadmap for Cisco Intrusion Prevention System
•Release Notes for Cisco Intrusion Prevention System
•Cisco Intrusion Prevention System Device Manager Configuration Guide
•Cisco Intrusion Prevention System Manager Express Configuration Guide
•Cisco Intrusion Prevention System Command Reference
•Cisco Intrusion Prevention System Appliance and Modules Installation Guide
•Installling and Removing Interface Cards in Cisco IPS-4260 and IPS 4270-20
•Regulatory Compliance and Safety Information for the Cisco Intrusion Detection and Prevention
System 4200 Series Appliance Sensor
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by
vertical bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.
courier font Terminal sessions and information the system displays appear in courier font.
< > Nonprinting characters such as passwords are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.

xix
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Preface
Obtaining Documentation and Submitting a Service Request
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional
information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and
revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed
and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free
service and Cisco currently supports RSS Version 2.0.

xx
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Preface
Obtaining Documentation and Submitting a Service Request