IPS Trusted IP's

learnsec · ‎12-15-2010

Dear all,

How can i configure an IPS-4215 running in inline mode to never deny a certain IP address(s) whatever signature was fired?

i used event action filter, but it is based on Signature ID, My question is to have a way to configure the IPS to never deny this ip address regardless of signatures fired.

One more issue, using event action filter to bypass an ip address with a certain port for a certain signature, what should be the value of the attribute named deny percentage? the default value is 100, while in my point of view it should be 0. to mean that 0% of packets are denied else, the whole action filter will mean nothing.

thank you

Christopher Dreier · ‎12-20-2010

Hello learnsec_0,

The Event Action Filter "Signature ID" in IME correlates to the signature-id-range attribute in the CLI. The field is a range. So you can enter all Signature IDs if you desire. Use caution when doing this, however, as you will lose the ability to correlate any signature events with that IP address.

Regarding the deny-attacker-percentage attribute - very good point. Thanks for bringing it up. Let me dive into this and get some further clarification about this attribute before posting a solution.

Thank you,

Blayne Dreier

Cisco TAC Escalation Team

**Please check out our Podcasts**

TAC Security Show: http://www.cisco.com/go/tacsecuritypodcast

TAC IPS Media Series: https://supportforums.cisco.com/community/netpro/security/intrusion-prevention?view=tags&tags=tac_ips_media_series

Christopher Dreier · ‎12-20-2010

Hello learnsec_0,

Here is an explanation of the deny-attacker-percentage/Deny Percentage attribute:

"The purpose of Deny Percentage is to filter a percentage of the sig actions.

The Deny Percentage subtracts a portion of the Deny Attacker, Deny Attacker Victim Pair, and Deny Attacker Service Pair Actions. (NOTE: Only set the Deny Percentage in the filter, do NOT select the action within the filter. Selecting the action will subtract the entire action.) When the action is added it will deny 100% of the packets. You can use the filter to lower this percentage below 100% (i.e. subtract a portion of the Deny Attacker action). If you match multiple filters (as described above) then the lowest percentage will be used. So if you match filters at 80%, 60%, and 70%, then the lowest 60% will be used. Only 60% of the packets will be dropped (40% allowed).

HOWEVER, this works primarily just for ICMP and UDP. You can't Deny a percentage of TCP. So 100% of TCP will always be denied. This leads to weird results with you do something like set Deny Percentage to 50% and the sig has a Deny Attacker action set. If 80% of the packets are TCP and 20% are ICMP or UDP. Then 100% of the TCP will be denied, and almost ALL of the ICMP and UDP will be allowed through. The requested Deny Percentage will be 50% but the actual will be around 80%."

I agree, this is confusing in its current implementation. I'll speak with the BU about how we can improve this feature and follow up in this thread.