5-6
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter5 Configuring Virtual Sensors
Adding, Editing, and Deleting Virtual Sensors
Note
For the ASA IPS modules (ASA 5500-X IPS SSP and ASA 5585-X IPS SSP),
normalization is performed by the adaptive security appliance and not the IPS.
•
inline-TCP-session-tracking-mode—Enables an advanced method used to identify duplicate TCP
sessions in inline traffic. The default is virtual sensor, which is almost always the best choice.
–
virtual-sensor —Specifies that all packets with the same session key (AaBb) within a virtual
sensor belong to the same session.
–
interface-and-vlan—Specifies that all packets with the same session key (AaBb) in the same
VLAN (or inline VLAN pair) and on the same interface belong to the same session. Packets with
the same key but on different VLANs or interfaces are tracked independently.
–
vlan-only—Specifies that all packets with the same session key (AaBb) in the same VLAN (or
inline VLAN pair) regardless of the interface belong to the same session. Packets with the same
key but on different VLANs are tracked independently.
Note
The ASA IPS modules (ASA 5500-X IPS SSP and ASA 5585-X IPS SSP) do not
support the inline TCP session tracking mode.
•
signature-definition—Specifies the name of the signature definition policy.
•
logical-interfaces—Specifies the name of the logical interfaces (inline interface pairs).
•
physical-interfaces—Specifies the name of the physical interfaces (promiscuous, inline VLAN
pairs, and VLAN groups):
–
subinterface-number—Specifies the physical subinterface number. If the subinterface-type is
none, the value of 0 indicates the entire interface is assigned in promiscuous mode.
•
no—Removes an entry or selection.
Adding a Virtual Sensor
To add a virtual sensor, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter service analysis mode.
sensor# configure terminal
sensor(config)# service analysis-engine
sensor(config-ana)#
Step 3
Add a virtual sensor.
sensor(config-ana)# virtual-sensor vs1
sensor(config-ana-vir)#
Step 4
Add a description for this virtual sensor.
sensor(config-ana-vir)# description virtual sensor 1
Step 5
Assign an anomaly detection policy and operational mode to this virtual sensor.
sensor(config-ana-vir)# anomaly-detection
sensor(config-ana-vir-ano)# anomaly-detection-name ad1
sensor(config-ana-vir-ano)# operational-mode learn