topic Re: IPS Events Variables in Network Security

IPS Events Variables

Rene Rolsted — Sun, 10 Mar 2019 12:15:23 GMT

I started to make my rules, so using variables instead of IP address or IP address ranges.
I use a variable in the "Events Action Filters", but I do not know whether you can use 2 variables. For example in the screen dump, here I would like to use 2 variables $ windows domain

Can I use 2 variables? It works fine with 1 variable

Re: IPS Events Variables

fadlouni — Fri, 11 Feb 2011 13:51:15 GMT

Hi Rene.

Unfortunately only one variable can be used. so you'll have to create a variable that matches all your critereas IF possible. for example summarizing networks instead of matching on several networks etc..

there is an enhancement request bug open for this CSCsb03854, it's not actively worked on however as it's an enhancement request and so it has lower priority than other bugs.

Regards,

Fadi.

If this answers your question, please mark the thread as resovled.

Re: IPS Events Variables

Rene Rolsted — Tue, 15 Feb 2011 08:59:32 GMT

Hi Fadi,

Thanks for your reply.
I hope soon Cisco have to fix this bug.

Best regard

Rene