general IPS question

[yong khang NG]

Hi forumers'

i am quite new to IPS.

few quesiton to ask

01. i install and configure the AIP-SSM-01 on my ASA unit, is it operating accordingly (attach 01 IPS)

02. the virtual sensor 0 event action i set show as attached (attach 02 VS), is it meaning to say when any anomoly activity that violate signature definition, and the signatature action enable with alert and log will generate the log that can view on sensor monitoring?

thanks

Noel

[sramakr2]

Hi Yong,

You can create many instances in device with different configurations

For Ex:

ad0, ad1, ad2

sig0,sig1,sig2

rules0,rules1,rules2

Here based on your requirement you can assign above policies to VS0.

Ie. traffic passigng through virtual sensor0(vs0) will monitor traffic based on the policy assignment

if you assign ad0,sig0,rules0 to Vs0 then VS0 monitor the traffic based the tunings you have done on sig0

To give one practical example:

Consider you have tuned one signature in sig0 which will block all incoming telnet session

So if you assign sig0 to VS0, then you cannot telnet to any of your intenal device

if you asign sig1 to VS0, You can telnet to any deice

Event action override wrks based on risk rating value. If the triggered signature has high value which comes under(High risk) then it will take action based on your configuration

Hope it help!

Thnaks,

Suresh.