IDSM

[steve554365]

Got idsm in a 6500. Too much traffic causing the load to go to 100%. Is there away to skip traffic to certain inbound destinations from getting inspected? I'm not talking about Event Action Filters as those don't stop the inspeciton, but just turn off actions. I want to say that any traffic to IPs A, B, C should be skipped by the engine. Is this possible?

[lcambron]

Hello,

It depends on how you are sending traffic to the IDSM.

You can use an ACL and deny it there:

ip access-list extended IPS
 deny ip any host x.x.x.x
 permit ip any any

vlan access-map 10
 match ip address IPS
 action forward capture

vlan filter 10 vlan-list 800

intrusion-detection module 8 data-port 1 capture allowed-vlan 800
intrusion-detection module 8 data-port 1 capture

Regards,

Felipe.