topic Re: How to unblock a web site in Network Security

How to unblock a web site

Smailmilak83_2 — Sun, 10 Mar 2019 12:06:13 GMT

Hi,

I dont have any experience with the Cisco IPS product.

I can not open a web site because of the IPS. When I shut down the IPS module the web site can be accessed.

Can you guys tell me how to allow access to a particular web site?

Re: How to unblock a web site

terrygwazdosky — Tue, 24 Aug 2010 16:25:56 GMT

You can edit or disable individual signatures, as well as create filters, but unless you know for sure that it is a false positive you could be opening a security hole.

Re: How to unblock a web site

praprama — Tue, 24 Aug 2010 16:43:17 GMT

Hi,

With the IPS active, try accessing the particular website and then view the events on the IPS using IDM. You will see some signature firing that is blocking access to that website.

http://www.cisco.com/en/US/docs/security/ips/6.2/configuration/guide/idm/idm_monitoring.html#wp1124764

You can then try disabling that particular signature or tune it to allow access to this website.

Let me know if this helps.

Regards,

Prapanch

Re: How to unblock a web site

Smailmilak83_2 — Thu, 26 Aug 2010 07:14:22 GMT

I checked the events and I can not find anything.

I see only this: CMP Network Sweep w/Echo id=2100. I can not find my IP address in this log.

The site is www.warez-bb.org. It probably has a bad reputation.

Is there a way to access this site with IPS?

Re: How to unblock a web site

praprama — Fri, 27 Aug 2010 12:19:31 GMT

Hi,

If the IPS is dropping the connections, you should see events corresponding to it. Let's try the following. Create an access-list of the following format assuming the IP of "warez-bb.org" is 1.1.1.1 (found out using "nslookup").

access-list ips permit ip any host 1.1.1.1

class-map IPS

match access-list ips

policy-map global_policy

class IPS

ips inline fail-open

service-policy global_policy global

By doing the above, we are just passing traffic destined to the site "www.warez-bb.org" thorugh the IPS. After you have done th above, please try accessing the site again and now whatever events you see on the IPS should be related to this one. Hope this helps.

Regards,

Prapanch