7-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Configuring Signature Variables
The Cisco IPS contains over 10,000 built-in default signatures. You cannot rename or delete signatures
from the list of built-in signatures, but you can retire signatures to remove them from the sensing engine.
You can later activate retired signatures; however, this process requires the sensing engines to rebuild
their configuration, which takes time and could delay the processing of traffic. You can tune built-in
signatures by adjusting several signature parameters. Built-in signatures that have been modified are
called tuned signatures.
Note
We recommend that you retire any signatures that you are not using. This improves sensor performance.
You can create signatures, which are called custom signatures. Custom signature IDs begin at 60000.
You can configure them for several things, such as matching of strings on UDP connections, tracking of
network floods, and scans. Each signature is created using a signature engine specifically designed for
the type of traffic being monitored.
Configuring Signature Variables
This section describes signature variables, and contains the following topics:
•
Understanding Signature Variables, page 7-4
•
Creating Signature Variables, page 7-4

Understanding Signature Variables

When you want to use the same value within multiple signatures, use a variable. When you change the
value of a variable, that variable is updated in all signatures in which it appears. This saves you from
having to change the variable repeatedly as you configure signatures.
Note
You must preface signature variables with a dollar ($) sign to indicate that you are using a variable rather
than a string.
Some variables cannot be deleted because they are necessa ry to the signature system. If a variable is
protected, you cannot select it to edit it. You receive an error message if you try to delete protected
variables. You can edit only one variable at a time.

Creating Signature Variables

Use the variables command in the signature definition submode to create signature variables.
The following options apply:
•
variable_name—Identifies the name assigned to this variable. A valid name can only contain
numbers or letters. You can also use a hyphen (-) or underscore (_).
•
ip-addr-range—Specifies the system-defined variable for grouping IP addresses. The valid values
are: A.B.C.D-A.B.C.D[,A.B.C.D-A .B.C.D]
•
web-ports—Specifies the system-defined variable for ports to look for HTTP traffic. To designate
multiple port numbers for a single variable, place a comma between the entries. For example, 80,
3128, 8000, 8010, 8080, 8888, 24326.