Cisco Systems 2.5 Assign Actions

Chapter27 Cisco IOS IPS
Edit IPS
27-50
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Name
Click Name to order the files and directories alphabetically based on name.
Clicking Name again will reverse the order.
Size
Click Size to order the files and directories by size. Directories always have a size
of zero bytes, even if they are not empty. Clicking Size again will reverse the
order.
Time Modified
Click Time Modified to order the files and directories based on modification da te
and time. Clicking Time Modified again will reverse the order.
Assign Actions
This window contains the actions that can be taken upon a s ignature match.
Available actions depend on the signature, but the most common actions are listed
below:
•alarm—Generate an alarm message. Same as produce-verbose-alert.
•deny-attacker-inline—Create an ACL that denies all traffic from the IP
address considered to be the source of the attac k by the Cisco IOS IPS system.
Same as denyAttackerInline.
•deny-connection-inline—Drop the packet and all future packets on this TC P
flow. Same as produce-alert and denyFlowInline.
•deny-packet-inline—Do not transmit this packet (inline only). Same as
drop.
•denyAttackerInline—Create an ACL that denies all traffic from the IP
address considered to be the source of the attac k by the Cisco IOS IPS system.
Same as deny-attacker-inline.
•denyFlowInline—Create an ACL that denies all traffic from the IP address
that is considered the source of the attack belonging to the 5-tuple (src ip, src
port, dst ip, dst port and l4 protocol). denyFlowInline is more granul ar than
denyAttackerInline. Same as produce-alert and deny-connection-inline.
•drop—Drop the offending packet. Same as deny-packet-inline.