Signature Tuning - Exception

[bill_martin]

I would like to create exceptions within particular signatures to ignore IP addresses. How do I perform this task?

[rhermes]

You want to configure an Event Action Override for this IP address.

http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/idm/dmEvtRul.html

- Bob

[Keith Craycraft]

Bill,

     I have found this is easier to do from the IME.

     go to the configuration at the top and when the configuration screen comes up select polices button on the left side.

     in the policy tree select IPS policies.  you should have an event actions section  from here you can select Add to create a new filter.

     Here is link for document for configuring this. http://www.cisco.com/en/US/docs/security/ips/5.1/configuration/guide/idm/dmEvtRul.html

Below is what the screen will be like, using the Demo version of IME.

I would play with this feature in the demo version of IME before i tried it in production.

Hope this helps

Keith

[bill_martin]

Thanks for the help however neither method will work.  We use CSM to manage the

devices and any change made locally will be overwritten by CSM!

[rhermes]

Bill -

You can create an Event Action Filter in CSM.

http://www.cisco.com/en/US/partner/docs/security/security_management/cisco_security_manager/security_manager/4.0.1/user/guide/ipsevact.html

- Bob

[bill_martin]

Bob,

Thanks, I give it a try...

Bill