7-17
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter7 Defining Signatures
Configuring Signatures
percentage
-----------------------------------------------
external-rate-limit-percentage: 50 default: 100
-----------------------------------------------
Step 9
Exit event action submode.
sensor(config-sig-sig-nor-eve-per)# exit
sensor(config-sig-sig-nor-eve)# exit
sensor(config-sig-sig-nor)# exit
sensor(config-sig-sig)# exit
sensor(config-sig)# exit
Apply Changes:?[yes]:
Step 10
Press Enter to apply the changes or enter
no
to discard them.
For More Information
For a detailed description of event actions, see Event Actions, page 8-4.
Configuring AIC Signatures
This section describes the Application Inspection and Control (AIC) signatures and how to configure
them. It contains the following topics:
•
Understanding the AIC Engine, page 7-17
•
AIC Engine and Sensor Performance, page 7-18
•
Configuring the Application Policy, page 7-18
•
AIC Request Method Signatures, page 7-20
•
AIC MIME Define Content Type Signatures, page 7-21
•
AIC Transfer Encoding Signatures, page 7-24
•
AIC FTP Commands Signatures, page 7-25
•
Creating an AIC Signature, page 7-26

Understanding the AIC Engine

AIC provides thorough analysis of web traffic. It provides granular control over HTTP sessions to
prevent abuse of the HTTP protocol. It allows administrative control over applications, such as instant
messaging and gotomypc, that try to tunnel over specified ports. Inspection and policy checks for P2P
and instant messaging are possible if these applications are running over HTTP. AIC also provides a way
to inspect FTP traffic and control the commands being issued. You can enable or disable the predefined
signatures or you can create policies through custom signatures.
Note
The AIC engines run when HTTP traffic is received on AIC web ports. If traffic is web traffic, but not
received on the AIC web ports, the Service HTTP engine is executed. AIC inspection can be on any port
if it is configured as an AIC web port and the traffic to be inspected is HTTP traffic.