Cisco IPS 4240

Question

HI,

how can i monitor the following device.

Manufacturer Part# IPS-4240-K9
    Product Type: Intrusion Detection System
    Number of Ports: 4
    Form Factor: Rack-mountable
    Input Voltage Range: 100 V AC to 240 V AC

is there a way. i have found other members posts too. how can i make this working. i can only see the traffic from the management interface only.

what i want to monitor is:

Attacks Per Action

Attacks Per Protocol

Attacks Per Severity

System Log Entries

TCP Stats

Streams - Blocked

Streams - Rate Limited

i hope there is way to accomplish this from solarwinds.

jswan · Answer

Just to add to what Andy said... I think the appropriate MIB would be the CISCO-CIDS-MIB:

ftp.cisco.com/.../CISCO-CIDS-MIB.oid

ftp.cisco.com/.../CISCO-CIDS-MIB.my

But from looking at it, it doesn't look like the stuff you want is available at all via SNMP. Also, the IPS doesn't support event monitoring via syslog. It's primarily designed around a pull model using a format called SDEE over SSL.

mcbridea · Answer

I'm not sure about this particular case but security appliances usually have minimal SNMP capibilities. I would recommend using syslog alerting.