topic Re: IPS bypass mode in Network Security

IPS bypass mode

Shaikh Aman Uddin — Sun, 10 Mar 2019 12:21:42 GMT

Hi,

Can we configure IPS in such a way that it can bypass traffic (few subnets) and inspect all other traffic in inline mode?

Aman

Re: IPS bypass mode

rhermes — Fri, 27 May 2011 15:50:14 GMT

If the traffic is passing thought your sensor it will get inspected.

You can create Event Action Filters or Event Action Overrides to change the sensor default behavior (sending events and potentially blocking traffic).

http://www.cisco.com/en/US/docs/security/ips/7.1/configuration/guide/idm/idm_event_action_rules.html

- Bob

Re: IPS bypass mode

Christopher Dreier — Wed, 01 Jun 2011 17:58:03 GMT

Hello Aman,

What model sensor(s) do you have? This is achievable by using the Modular Policy Framework (MPF) on the ASA to forward traffic down to the IPS modules.

Thank you,

Blayne Dreier

Cisco TAC Escalation Team

**Please check out our Podcasts**

TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

TAC IPS Media Series: https://supportforums.cisco.com/docs/DOC-12758