Signature Actions on IPS 4240

[Kevin Melton]

If a default action on a specific signature is configured to "produce alert" only, why is it that the IPS will also Log packet from the attacker? I would have thought that this would have required that the action "Log attacker packets" be selected as well.

[dsweeny]

Use the Installing and Using Cisco Intrusion Prevention System Manager Express 6.1 Configuring Policies and Cisco 4240-DC Intrusion Prevention Sensor guide.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/ps5768/prod_bulletin0900aecd8030c5da.html

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/ime/ime_policies.html