Cisco Systems RVS4000RF manual IPS Configuration, Anomaly Detection

Setting Up and Configuring the Router	5
IPS

IPS

IPS > Configuration

IPS > Configuration

IPS Function Select Enable to enable or Disable to disable the IPS Function.

Anomaly Detection

HTTP Web attack signature is matched. HTTP request decoder decodes UTF-8 (1, 2, and 3 byte) code and normalize URI (according to those evasion methods mentioned in whisker) before pattern match.

FTP FTP Bounce Detection and Inserting telnet opcodes into FTP command stream Detection.

TELNET Normalization of Telnet negotiation strings.

RPC RPC record fragging detection.

Signature Update Before upgrading the signature file, get the Router Intrusion Prevention System (IPS) file from the Cisco website. To find the file, go to www.cisco.com/go/software (registration/login required), and search for RVS4000. After downloading and extracting the file, enter the IPS Signature file name in the Signature Update field, or click Browse to find the file. Then click Update and follow the on-screen instructions.

Cisco RVS4000 Security Router with VPN Administrator Guide 82