Resolution
The Cisco PIX Firewall added Intrusion Detection System (IDS) support starting in PIX Software version 5.2. The IDS signatures are divided into two categories: info (informational) and attack signatures. The IDS feature is not enabled by default. Use the ip audit command to apply the IDS inspection to traffic coming into an interface. When an IDS signature is matched, the PIX can perform one or more of the following actions on the packet:
- Alarm (write a syslog message)
- Drop (drop the packet), or
- Reset (send a reset packet to the sender)
In the following example, the PIX is configured to log all information signatures, and to log, drop and reset all attack signatures coming into the PIX Firewall through the outside interface.
ip audit name info_sigs info action alarm
ip audit name attack_sigs attack action alarm drop reset
Refer to the PIX Firewall Configuration section of Configuring the Cisco Secure PIX Firewall with Three Internal Networks for a typical example of how to configure IP audit on the PIX Firewall.
