28-6
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter28 Using Protection Tools
Configuring IP Audit for Basic IPS Support
Fields
•Policy Name—Sets the IP audit policy name. You cannot edit the name after you add it.
•Policy Type—Sets the policy type. You cannot edit the policy type after you add it.
–
Attack—Sets the policy type as attack.
–
Information—Sets the policy type as informational.
•Action—Sets one or more actions to take when a packet matches a signature. If you do not choose
an action, then the default policy is used.
–
Alarm—Generates a system message showing that a packet matched a signature. For a complete
list of signatures, see IP Audit Signature List.
–
Drop—Drops the packet.
–
Reset—Drops the packet and closes the connection.
IP Audit Signatures
The Configuration > Firewall > Advanced > IP Audit > IPAudit Signatures pane lets y ou disable audit
signatures. You might want to disable a signature if legitimate traffic continually matches a signature,
and you are willing to risk disabling the signature to avoid large numbers of alarms.
For a complete list of signatures, see the “IP Audit Signature List” section on page28-6.
Fields
•Enabled—Lists the enabled signatures.
•Disabled—Lists the disabled signatures.
•Disable—Moves the selected signature to the Disabled pane.
•Enable—Moves the selected signature to the Enabled pane.
IP Audit Signature List
Table28-1 lists supported signatures and system message numbers.
Table28-1 Signature IDs and System Message Numbers
Signature
ID
Message
Number Signature Title Signature Type Description
1000 400000 IP options-Bad Option List Informational Triggers on receipt of an IP datagram where
the list of IP options in the IP datagram header
is incomplete or malformed. The IP options
list contains one or more options that perform
various network management or debugging
tasks.
1001 400001 IP options-Record Packet Route Informational Triggers on receipt of an IP datagram where
the IP option list for the datagram includes
option 7 (Record Packet Route).