Content
Implementing Cisco Intrusion Prevention System Remote Labs v7.0
This exercise bundle supports the Implementing Cisco Intrusion Prevention Systems (IPS) v 7.0 course that teaches the skills needed to design, install, configure, and maintain a Cisco Intrusion Prevention solution. In this set of exercises, the students use the Command Line Interface (CLI) and the IPS Device Manager (IDM) to configure, maintain and monitor the Cisco IPS sensor. They perform extensive testing to verify the signature configuration on a topology illustrated by the figure.
Content
This set of lab exercises contains the following exercises:
- Performing the Cisco IPS Sensor Initial Setup
- Managing a Cisco IPS Sensor
- Configuring and Modifying Basic Cisco IPS Signatures and Responses
- Configuring Cisco IPS Anomaly-Based Operation
- Configuring Custom Cisco IPS Signatures
- Managing False Positives and False Negatives
- Improving Alarm and Response Quality
- Using the Cisco IME
- Configuring Policy Virtualization
Objectives
Upon finishing this set of exercises, you will be able to:
Configure a Cisco IPS sensor using the CLI setup command
- Verify Cisco IPS manageability using SSH access from an authorized host
- Launch Cisco IDM and familiarize yourself with the Cisco IDM interface
- Navigate the sensor CLI
- Back up and restore Cisco IPS configuration
- Create user accounts, and assign privileges to user accounts
- Configure NTP
- Update Cisco IPS software and apply signature updates
- Display sensor events
- Configure, modify, and verify Cisco IPS built-in signatures and responses
- Configure the anomaly-based detection and prevention features of the Cisco IPS sensor
- Configure custom Cisco IPS signatures to prevent or detect attacks.
- Observe false triggering of some built-in signatures
- Tune signatures to eliminate false positives
- Address false negatives of a built-in signature
- Configure and verify Cisco IPS features that improve prevention and detection quality
- Configure Cisco IME to view and report on Cisco IPS events
- Examine information on Cisco IPS signatures and other security intelligence that is available online
- Configure multiple virtual sensors and policy virtualization on a Cisco IPS sensor
Importance
The lab bundle is a prerequisite for all students involved in planning, designing, deploying and operating firewall systems that include Cisco intrusion prevention solutions.
Target Audience
Cisco customers who implement and maintain Cisco IPS systems
Prerequisite Knowledge
Students should have experience with the Cisco IOS or IPS command line and should meet the following prerequisites: