Migrating to IPS mode

[Henk Fictorie - Ulrich]

Hi,

We are currently running our 8250's in an IDS mode and we are changing to an IPS mode. 

We have lots of rules which are now resulting in a "would be block", that is going to change to a Block result. To ease the migration I'm looking for ways of slowly moving to Block results.

I'm thinking of dividing the 'would be block' rules into groups and changing the the result of those groups initial to monitor and group after group changing the results back to block.

Is this a sane idea and if so what is a decent way of dividing the rules into groups?

Henk Fictorie

[Dennis Perto]

When you say that the rule is making the result "would have been dropped" is that an access control rule, or the actual IDS/IPS policy making that verdict?