Cisco Systems IPS4510K9 manual Adding Virtual Sensors

Chapter 5 Configuring Virtual Sensors

Adding, Editing, and Deleting Virtual Sensors

Adding Virtual Sensors

Use the virtual-sensorname command in service analysis engine submode to create a virtual sensor. You can create up to four virtual sensors. You assign policies (anomaly detection, event action rules, and signature definition) to the virtual sensor. Then you assign interfaces (promiscuous, inline interface pairs, inline VLAN pairs, and VLAN groups) to the virtual sensor. You must configure the inline interface pairs and VLAN pairs before you can assign them to a virtual sensor.

Note Anomaly detection is disabled by default. You must enable it to configure or apply an anomaly detection policy. Enabling anomaly detection results in a decrease in performance.

The following options apply:

•http-advanced-decoding {true false}—Enables deeper inspection of HTTP traffic. The default is disabled.

Note Enabling HTTP advanced decoding severely impacts system performance.

Note HTTP advanced decoding is supported on the IPS 4345, IPS 4360, IPS 4510, IPS 4520, ASA 5585-X IPS SSP, ASA 5525-X IPS SSP, ASA 5545-X IPS SSP, and

ASA 5555-X IPS SSP.

•anomaly-detection—Specifies the anomaly detection parameters:

–anomaly-detection-namename—Specifies the name of the anomaly detection policy.

–operational-mode—Specifies the anomaly detection mode (inactive, learn, detect).

•description—Description of the virtual sensor.

•event-action-rules—Specifies the name of the event action rules policy.

•inline-TCP-evasion-protection-mode—Lets you choose which type of normalization you need for traffic inspection:

–asymmetric —Specifies that the sensor can only see one direction of bidirectional traffic flow. Asymmetric mode protection relaxes the evasion protection at the TCP layer.

Note Asymmetric mode lets the sensor synchronize state with the flow and maintain inspection for those engines that do not require both directions. Asymmetric mode lowers security because full protection requires both sides of traffic to be seen.

–strict—Specifies that if a packet is missed for any reason, all packets after the missed packet are not processed. Strict evasion protection provides full enforcement of TCP state and sequence tracking.

Note Any out-of-order packets or missed packets can produce Normalizer engine signatures 1300 or 1330 firings, which try to correct the situation, but can result in denied connections.

Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2

OL-29168-01 5-5