02-17-2014 01:55 PM - edited 03-10-2019 06:09 AM
Dear All,
In our AIP-SSM 20 signature 11020/0 1 /2/3 & 4 are configured to be denied.
Is there any way we can exclude 01 IP from being denied by this signature?
Any reponse would be appreciated.
Thanks
02-17-2014 02:28 PM
You will need to create an event action filter "service event-action-rules rules0" section of the CLI or through the GUI you can click on Configuration\Policies\Event Action Rules\rules0, click on the Event Action Filters tab on the right. Create a filter for the source or destination IP address, specify the signature(s) you want to filter on, and then select the actions to remove, such as create alert or drop packet.
Jon.
02-19-2014 10:05 AM
True JonPBerbee,
Here is further readup to corroborate...
http://popravak.wordpress.com/2012/04/30/event-action-filters/
Daniel.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide