IOS Firewall Intrusion Detection System

The IOS Firewall IDS feature acts as an inline sensor, watching packets and sessions as they flow through the router, scanning each for pattern matches to any known IDS signatures. When packets in a session match a signature, the IDS system can be configured to do the following:

• Send an alarm to a Syslog server and/or to a Cisco Secure IDS Director centralized management device (formerly the NetRanger system).

• Discard the packet.

• Reset the TCP connection.

While enabling both the firewall and intrusion detection features of the CBAC security engine to support a network security policy is preferable, each of these features can be enabled independently and on different router interfaces.