topic Re: Disabling sig via CLI in Network Security

Disabling sig via CLI

gdntsoc — Sun, 10 Mar 2019 09:21:11 GMT

Apologies in advance for the newbie question but I can't seem to figure out the straightforward process to get this done.

Working with a Cisco 4215 running 4.1(4). All I'm looking to do is disable 'ICMP Network Sweep w/Echo' (SIGID 2100, subSIGID 0) via the CLI. I've got as far as

# conf t

# service virtual-sensor-configuration virtualSensor

# tune-micro-engines

I see the signature engines but am uncertain as to which sig engine is associated with 'ICMP Network Sweep w/Echo' and then how to disable from there. Thanks in advance for any assistance.

Re: Disabling sig via CLI

a.arndt — Thu, 24 Mar 2005 16:39:46 GMT

When you access the sensor via CLI, is it via console or SSH?

I ask because if you're using SSH, it would be far easier to turn off SigID 2100 using IDM. Of course, access to a sensor's configuration via IDM is performed using a web browser.

To get back to your question about which engine is associated with SigID 2100, it is SWEEP.HOST.ICMP

There are three SigIDs under the engine; 2100, 2101 and 2102. This should get you going again under CLI if you're stuck with local access to the sensor via console only.

I hope this helps,

Alex Arndt

Re: Disabling sig via CLI

gdntsoc — Thu, 24 Mar 2005 16:48:43 GMT

Alex,

That helped tremendously. Thank you. Two quick follow up questions...

1. How does one associate a signature with a specific engine? I know that the engine name is a start but is there a table I can reference somewhere?

2. When I disable a sig, is that permanent? In otherwords, will applying new signature updates overwrite my changes?

Thank you again.

Re: Disabling sig via CLI

mkodali — Fri, 25 Mar 2005 06:44:28 GMT

If I understood your question correctly, you can try "show setting | include " after tune command as shown below :

sensor(config)# ser virtual-sensor-configuration virtualSensor

sensor(config-vsc)# tune

sensor(config-vsc-virtualSensor)# show set | include 2100

SWEEP.HOST.ICMP

-----------------------------------------------

signatures (min: 0, max: 1000, current: 3)

-----------------------------------------------

SIGID: 2100

-----------------------------------------------

This will provide you the engine name.

Answer to your second question, yes the sig will be disabled and applying new signature update will not overwrite the changes.

Re: Disabling sig via CLI

gdntsoc — Fri, 25 Mar 2005 13:43:14 GMT

That's exactly what I was looking for. Thanks again for the help, I really appreciate it.