Cisco Systems IPS4510K9 manual Configuring the Denied Attackers List

Chapter 8 Configuring Event Action Rules

Configuring the Denied Attackers List

Step 8 Enable or disable any overrides that you have set up. The default is enabled.

sensor(config-eve-gen)#global-overrides-status {enabled disabled}

Step 9 Enable or disable any filters that you have set up. The default is enabled.

sensor(config-eve-gen)#global-filters-status {enabled disabled}

Step 10 Verify the settings for general submode.

sensor(config-eve-gen)# show settings general

-----------------------------------------------

global-overrides-status: Enabled default: Enabled

global-filters-status: Enabled default: Enabled

global-summarization-status: Enabled default: Enabled

global-metaevent-status: Enabled default: Enabled

global-deny-timeout: 1000 default: 3600

global-block-timeout: 20 default: 30

max-denied-attackers: 100 default: 10000

-----------------------------------------------

sensor(config-eve-gen)#

Step 11 Exit event action rules submode.

sensor(config-eve-gen)# exit sensor(config-eve)# exit Apply Changes:?[yes]:

Step 12 Press Enter to apply your changes or enter no to discard them.

Configuring the Denied Attackers List

This section describes the denied attackers list and how to add, clear, and monitor the list. It contains the following topics:

•Adding a Deny Attacker Entry to the Denied Attackers List, page 8-35

•Monitoring and Clearing the Denied Attackers List, page 8-36

Adding a Deny Attacker Entry to the Denied Attackers List

Use the deny attacker [virtual-sensor name] [ip-address attacker-ip-address] victim victim-ip-addressport port-number] command to add a single deny attacker entry to the list of denied attackers. Use the no form of the command to delete the deny attacker entry from the list.

The following options apply:

•name—(Optional) Specifies the name of the virtual sensor to which the deny attackers entry should be added.

•attacker-ip-address—Specifies the attacker IP address.

•victim-ip-address—(Optional) Specifies the victim IP address.

•port-number—(Optional) Specifies the victim port number. The valid range is 0 to 65535.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		8-35