topic configure an excepcion for a host in an IPS4260 in Network Security

configure an excepcion for a host in an IPS4260

Luis Carranza — Sun, 10 Mar 2019 12:26:22 GMT

Hi guys!!

I need your help to know if it's possible to configure an excepcion for a specific host or ip address in an IPS 4260, I can do this in an AIP-SSM configuring an access-list, but I think it's different on an appliance.

Regards

configure an excepcion for a host in an IPS4260

raga.fusionet — Thu, 04 Aug 2011 20:33:45 GMT

Hi Luis,

An exception on IPS is called an event action filter, I was looking for a config example but instead I found this nice youtube video:

http://www.youtube.com/watch?v=Ho945eUSwbo

If you have a host that is firing a lot of false positives just select it as "attacker" and leave the signature range blank if you dont want to see any signature at all coming from this guy.

I hope this helps.

Raga

configure an excepcion for a host in an IPS4260

raga.fusionet — Thu, 04 Aug 2011 20:36:46 GMT

Thinking about it, I dont think blank works. You can enter a single signature ID, a comma-separated list, or a range of IDs. The default is to apply the rule to signatures in the range 900-65535.

configure an excepcion for a host in an IPS4260

rhermes — Thu, 04 Aug 2011 20:36:58 GMT

Luis is correct, you want to configure an Event Action Filter for your host IP.

Here's the documentation page for 7.0 CLI:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_event_action_rules.html#wp1030749

- Bob

configure an excepcion for a host in an IPS4260

Luis Carranza — Thu, 04 Aug 2011 21:29:13 GMT

Thanks Luis

This was really helpful!!!

Thanks

configure an excepcion for a host in an IPS4260

raga.fusionet — Thu, 04 Aug 2011 22:02:50 GMT

Awesome, Glad I could help

Have a good one!