Interoperability With Other Ips Modules; Restrictions - Cisco IPS-4255-K9 - Intrusion Protection Sys 4255 Installation Manual

Chapter 8 Installing the NME IPS
•

Interoperability With Other IPS Modules

You cannot upgrade an NM CIDS to an NME IPS.
Caution
The Cisco access routers only support one IDS/IPS module per router. If you have more than one
IDS/IPS module installed, the most capable card is enabled. The most capable hierarchy is:
1.
2.
3.
This means, for example, that if all modules are installed, the NME IPS disables all other modules. The
AIM IPS disables all NM CIDS. If there are multiple modules with the same level of capability, the first
one discovered is enabled and all others are disabled.
You cannot bring up, enable, or configure a disabled module. To bring up a less capable module, you
must remove the more capable module from the router and reboot. Disabled modules are reported in the
show diag command output. The state of the module is reported as present but disabled.
If the most capable module slot and port do not match the interface ids slot/port configuration
command, the most capable module is disabled with the following warning:
The module in slot x will be disabled and configuration ignored.
The correct slot/port number are displayed so that you can change the configuration.
For More Information
For more information on NM CIDS, refer to

Restrictions

The following restrictions apply to the NME IPS:
•
•
OL-18504-01
Supported Cisco IOS Feature Sets:
Cisco IOS Advanced Security
–
Cisco IOS Advanced IP Services
–
Cisco IOS Advanced Enterprise Services
–
NME IPS
AIM IPS
NM CIDS
Do not deploy IOS IPS and the NME IPS at the same time.
When the NME IPS is used with an IOS firewall, make sure SYN flood prevention is done by the
IOS firewall.
The NME IPS and the IOS firewall complement each other's abilities to create security zones in the
network and inspect traffic in those zones. Because the NME IPS and the IOS firewall operate
independently, sometimes they are unaware of the other's activities. In this situation, the IOS
firewall is the best defense against a SYN flood attack.
Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.0
Interoperability With Other IPS Modules
Introducing NM CIDS and Installing NM CIDS.
8-3