Configure IOS Intrusion Prevention (IPS)

1. Create and define a directory for IPS configuration files

mkdir flash:/ips

2. Import the Cisco RSA public key (available from the cisco.com download area)

crypto key pubkey-chain rsa
  named-key realm-cisco.pub signature
    key-string
    ....
    quit

3. (optional) create an ACL to define what traffic gets inspected

ip access-list extended IPS-INSPECT
  permit ip any host 1.2.3.4
  permit ip host 1.2.3.4 any
!
ios ips name IPS1 list IPS-INSPECT

4. Retire and un-retire signature sets

ip ips signature-category
  category-all
    retired true
  category ios_ips_basic
    retired false
    exit
  exit

5. Apply the IPS configuration to an interface

int gi0/0
  ip ips IPS1 in
  ip ips IPS1 out

6. Upload signature definitions

copy ftp://cisco:cisco@10.1.1.1/IOS-S310-CLI.pkg idconf

7. (optional) enable syslog notifications for IPS events

ip ips notify log

8. (optional) enable SDEE notifications for IPS events

access-list 80 permit 2.2.2.2
ip http access-class 80
ip http server enable
ip ips notify sdee

9. (optional) Tweak individual signatures

ip ips signature-definition
  signature 6130 10
    engine
      event-action produce-alert
      event-action deny-packet-inline
      exit
    exit
  exit

10. Verification

show ip ips signature count

Based on Keith Barker’s blog post at InternetworkExpert and this Cisco.com technote.