IPS Events Variables

[Rene Rolsted]

I started to make my rules, so using variables instead of IP address or IP address ranges.
I use a variable in the "Events Action Filters", but I do not know whether you can use 2 variables. For example in the screen dump, here I would like to use 2 variables $ windows domain

Can I use 2 variables? It works fine with 1 variable

[fadlouni · Accepted solution]

Hi Rene.

Unfortunately only one variable can be used. so you'll have to create a variable that matches all your critereas IF possible. for example summarizing networks instead of matching on several networks etc..

there is an enhancement request bug open for this CSCsb03854, it's not actively worked on however as it's an enhancement request and so it has lower priority than other bugs.

Regards,

Fadi.

If this answers your question, please mark the thread as resovled.

[Rene Rolsted]

Hi Fadi,

Thanks for your reply.
I hope soon Cisco have to fix this bug.

Best regard

Rene