Cisco Systems IPS4510K9 Adding Virtual Sensors

5-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter5 Configuring Virtual Sensors
Adding, Editing, and Deleting Virtual Sensors
Adding Virtual Sensors
Use the virtual-sensor name command in service analysis engine submode to create a virtual se nsor.
You can create up to four virtual sensors. You assign policies (anomaly detection, event action rules, and
signature definition) to the virtual sensor. Then you assign interfaces (promiscuous, inline interface
pairs, inline VLAN pairs, and VLAN groups) to the virtual sensor. You must configure the inline
interface pairs and VLAN pairs before you can assign them to a v irtual sensor.
Note Anomaly detection is disabled by default. You must enable it to configure or apply an anomaly detection
policy. Enabling anomaly detection results in a decrease in performance.
The following options apply:
• http-advanced-decoding {true | false}—Enables deeper inspection of HTTP traffic. The default is
disabled.
Note Enabling HTTP advanced decoding severely impacts system performa nce.
Note HTTP advanced decoding is supported on the IPS 4345, IP S 4360, IPS 4510, IPS 4520,
ASA 5585-X IPS SSP, ASA5525-X IPS SSP, ASA 5545-X IPS SSP, and
ASA 5555-X IPS SSP.
• anomaly-detection—Specifies the anomaly detection parameters:
– anomaly-detection-name name—Specifies the name of the anomaly detection policy.
– operational-mode—Specifies the anomaly detection mode (inactive, learn, detect).
• description—Description of the virtual sensor.
• event-action-rules—Specifies the name of the event action rules policy.
• inline-TCP-evasion-protection-mode—Lets you choose which type of normalization you need for
traffic inspection:
– asymmetric —Specifies that the sensor can only s ee one direction of bidirectional traffic flow.
Asymmetric mode protection relaxes the evasion protection at the TCP layer.
Note Asymmetric mode lets the sensor synchronize state with the flow and maintain
inspection for those engines that do not require both directions. Asymmetric mode
lowers security because full protection requires both sides of traffic to be seen.
– strict—Specifies that if a packet is missed for any reason, all packets after the missed packet
are not processed. Strict evasion protection provides full enfo rcement of TCP state and
sequence tracking.
Note Any out-of-order packets or missed packets can produce Normalizer engine signatures
1300 or 1330 firings, which try to correct the situation, but can result in denied
connections.