topic Re: Whitelist IP from IPS in Network Security

Whitelist IP from IPS

Stuart-ITGL — Wed, 03 Jul 2019 14:47:36 GMT

Have a pair of 5515-IPS that are having a pen test done soon. We need to whitelist the pen test company IP addr from the IPS module.

Does anyone have any suggestions on how to do this? Had thought of possibly excluding those addresses from the policy map and/r class map but not sure which one or how to do that.

TIA

Re: Whitelist IP from IPS

Mohammed al Baqari — Thu, 04 Jul 2019 05:37:51 GMT

Just exclude them from policy-map.

Re: Whitelist IP from IPS

Stuart-ITGL — Thu, 04 Jul 2019 08:36:09 GMT

Thanks for that

At the moment all traffic is sent via IPS just under the global policy map. What would be the best way to exclude the 2 IP addresses that need to be whitelisted?

Re: Whitelist IP from IPS

Marvin Rhoads — Thu, 04 Jul 2019 14:52:00 GMT

If your IPS class map currently uses a "match any" then just change it to "match access-list <acl name>".

Make the ACL simple - first deny the pen testing address(es) then permit all.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/mpf.html#wpxref87994

Re: Whitelist IP from IPS

Stuart-ITGL — Fri, 05 Jul 2019 14:01:15 GMT

And doing that will effectively whitelist the pen test addresses from the IPS module and cause them to bypass that side of things?

Just wanting to make sure I've understood correctly

Re: Whitelist IP from IPS

Marvin Rhoads — Fri, 05 Jul 2019 14:51:06 GMT

Correct. The Pen testing address(es) never get evaluated by the IPS module if you do that.