<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>yurisk.info &#187; Cisco IPS</title>
	<atom:link href="http://yurisk.info/category/cisco-ips/feed/" rel="self" type="application/rss+xml" />
	<link>http://yurisk.info</link>
	<description>Technical Blog about IT Security and Networking</description>
	<lastBuildDate>Tue, 07 Sep 2010 12:42:44 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0</generator>
		<item>
		<title>Cisco IPS sensor &#8211; initial setup</title>
		<link>http://yurisk.info/2010/02/28/cisco-ips-sensor-initial-setup/</link>
		<comments>http://yurisk.info/2010/02/28/cisco-ips-sensor-initial-setup/#comments</comments>
		<pubDate>Sun, 28 Feb 2010 16:05:30 +0000</pubDate>
		<dc:creator>Yuri</dc:creator>
				<category><![CDATA[Cisco IPS]]></category>

		<guid isPermaLink="false">http://yurisk.info/?p=530</guid>
		<description><![CDATA[Hello everyone. As I proceed in my studies towards the CCIE Security lab I&#8217;m starting a new category on the site – Cisco IPS. I will be posting all the things I learn about this gear, even the basics as I noted that on the Internet Cisco IPS sensors are not much talked about and [...]]]></description>
			<content:encoded><![CDATA[<div class="portant">Hello everyone. As I proceed in my studies towards the CCIE Security lab I&#8217;m starting a new category on the site – Cisco IPS. I will be posting all the things I learn about this gear, even the basics as I noted that on the Internet Cisco IPS sensors<br />
are not much talked about and while not sure why this is so, I’ll try to fill the gap.In all cases I am using CIsco IPS sensor 4235 unless specified otherwise </div>
<p>Initial Configuration.<br />
By default , out of the box the sensor has the following defaults:</p>
<div>Management IP: 10.1.9.201/24<br />
Default gateway: 10.1.9.1 Allowed access: from the network 10.1.9.201/24<br />
Telnet access: disabled<br />
HTTPS: port 443 </div>
<p>As most likely your network has different network address the first thing to do is change management IP, default gateway and allowed management access network(s)/IP. You do so by connecting with console to it .<br />
You can configure these basic network settings in 2 ways: enter all the configuration commands on CLI (if you know them) or run interactive menu-type setup by issuing on the CLI: <strong>#setup </strong>. I’ll show both ways but let&#8217;s start with the setup menu.<br />
A short remark – IPS sensor is the one of not so many devices in the Cisco family that configuring/managing/communicating with it using its GUI interface is the recommended and preferred way . It is much more intuitive, simple, produces the very same configuration at the device as done in CLI. The only time you may need to do stuff with CLI is initial setup and debug.</p>
<p>Configuring minimal required settings through setup menu:</p>
<ol>
<li>Connect to the device by terminal </li>
<li>enter default user/password: cisco/cisco (or see the documentation coming with the device);</li>
<li>run:<br />
sensor# setup</li>
</ol>
<p>-	First you are presented with the whole configuration currently set, just hit Space key until it reaches the end and asks whether you want to enter the setup dialog , print yes and Enter:</p>
<pre>
Continue with configuration dialog?[yes]:
Enter host name[sensor]: IPS4235  <span class="reg">Here I set hostname to IPS4235</span>
Enter IP interface[10.1.9.201/24,10.1.9.1]: 10.0.0.33/24,10.0.0.254  <span class="reg"> Pay attention to the syntax of specifying the management IP its subnet mask and default gateway</span>
Enter telnet-server status[disabled]: enable    <span class="reg"> I say yes here but you are advised to say no on production devices</span>
Enter web-server port[443]:        <span class="reg"> Default https listening port</span>
Modify current access list?[no]: yes
Current access list entries:
  No entries
Permit: 10.0.0.100/32             <span class="reg">    I allow management access to the device form this specific station </span>
Permit:                    <span class="reg">   Hit Enter to move to the next menu item</span>
Modify system clock settings?[no]: no
Modify summer time settings?[no]: no
Modify system timezone?[no]: no
Modify interface/virtual sensor configuration?[no]: no
Modify default threat prevention settings?[no]:
------cut here------------
exit exit
</pre>
<p>Upon finishing all the menu items in the dialog you are presented with the configuration you just entered :</p>
<pre>The following configuration was entered.
service host
network-settings
host-ip 10.0.0.33/24,10.0.0.254
host-name IPS4235
telnet-option enabled
access-list 10.0.0.100/32
ftp-timeout 300
no login-banner-text
exit
time-zone-settings
exit
summertime-option disabled
ntp-option disabled
exit
service web-server port 443 </pre>
<p>At the end of the output you are given the following choices:</p>
<pre>[0] Go to the command prompt without saving this config.
[1] Return back to the setup without saving this config.
[2] Save this configuration and exit setup.
 Enter your selection[2]:   2 </pre>
<p>Then device asks to reboot in order for the changes to take effect – confirm that.<br />
After reboot you may enter the sensor using supported browser by the management IP: https://10.0.0.33<br />
Also make sure the station you are connecting from has Java virtual machine installed as the GUI is entirely based on it.</p>
]]></content:encoded>
			<wfw:commentRss>http://yurisk.info/2010/02/28/cisco-ips-sensor-initial-setup/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
