7-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter7 Defining Signatures
Configuring Signature Variables
Adding, Editing, and Deleting Signature Variables
To add, edit, and delete signature variables, follow these steps:
Step 1
Log in to the CLI using an account with administrator or operator privileges.
Step 2
Enter signature definition submode.
sensor# configure terminal
sensor(config)# service signature-definition sig1
Step 3
Create a signature variable for a group of IP addresses.
sensor(config-sig)# variables IPADD ip-addr-range 10.1.1.1-10.1.1.24
Step 4
Edit the signature variable for web ports. WEBPORTS has a predefined set of ports where w eb servers
are running, but you can edit the value. This variable affects all signatures that have web ports. The
default is 80, 3128, 8000, 8010, 8080, 8888, 24326.
sensor(config-sig)# variables WEBPORTS web-ports 80,3128,8000
Step 5
Verify the changes.
sensor(config-sig)# show settings
variables (min: 0, max: 256, current: 2)
-----------------------------------------------
variable-name: IPADD
-----------------------------------------------
ip-addr-range: 10.1.1.1-10.1.1.24
-----------------------------------------------
<protected entry>
variable-name: WEBPORTS
-----------------------------------------------
web-ports: 80,3128,8000 default: 80-80,3128-3128,8000-8000,8010-8010,80
80-8080,8888-8888,24326-24326
-----------------------------------------------
Step 6
Delete a variable.
sensor(config-sig)# no variables IPADD
Step 7
Verify the variable has been deleted.
sensor(config-sig)# show settings
variables (min: 0, max: 256, current: 1)
-----------------------------------------------
<protected entry>
variable-name: WEBPORTS
-----------------------------------------------
web-ports: 80,3128,8000 default: 80-80,3128-3128,8000-8000,8010-8010,80
80-8080,8888-8888,24326-24326
-----------------------------------------------
Step 8
Exit signature definition submode.
sensor(config-sig)# exit
Apply Changes:?[yes]:
Step 9
Press Enter to apply the changes or enter
no
to discard them.