need to turn off IDS normalization engine.

syjeon — Sun, 10 Mar 2019 12:16:24 GMT

Hi all.

I would like to know how can we turn off cisco ids nomalization engine? Is it complicated one or not?

We have some issue when we enable cisco nomalization engine on ids which is inline mode. some of assymetric traffic will be dropped.

So, we are going to disable cisco nomalization, now.

please give us any advice for us.

Thanks you.

Re: need to turn off IDS normalization engine.

Justin Teixeira — Fri, 18 Feb 2011 18:09:26 GMT

Hi Syjeon,

You can set the normalizer mode for the virtual sensor in question to "Asymmetric Mode Protection" to relax the TCP normalization if the sensor is inspecting asymmetric traffic:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_virtual_sensors.html#wp1034136

You'll want to change the "inline-TCP-evasion-protection-mode" option from "strict" to "asymmetric" for each of the virtual sensors seeing asymmetric traffic.

-Justin

topic need to turn off IDS normalization engine. in Network Security

need to turn off IDS normalization engine.

Re: need to turn off IDS normalization engine.