Cisco Systems IPS4510K9 AIC Engine and Sensor Performance, Configuring the Application Policy

7-18
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Configuring Signatures
AIC has the following categories of signatures:
• HTTP request method
– Define request method
– Recognized request methods
• MIME type
– Define content type
– Recognized content type
• Define web traffic policy
There is one predefined signature, 12674, that specifies the action to take when noncompliant HTTP
traffic is seen. The parameter Alarm on Non HTTP Traffic enables the signature. By default this
signature is enabled.
• Transfer encodings
– Associate an action with each method
– List methods recognized by the sensor
– Specify which actions need to be taken when a chunked encoding err or is seen
• FTP commands
– Associates an action with an FTP command.
For More Information
• For a list of signature IDs and descriptions for these signatures, see AIC Request Method Signatur es,
page 7-20, AIC MIME Define Content Type Signatures, page 7-21, AIC Transfer Encoding
Signatures, page 7-24, and AIC FTP Commands Signatures, page 7-25.
• For the procedure for creating a custom MIME signature, see Creating an AIC Signature, page 7-26.
AIC Engine and Sensor Performance
Application policy enforcement is a unique sensor feature. Rather than b eing based on traditional IPS
technologies that inspect for exploits, vulnerabilities, and anomalies, AIC policy enforcement is
designed to enforce HTTP and FTP service policies. The inspection work required for this policy
enforcement is extreme compared with trad itional IPS inspection work. A large performance penalty is
associated with using this feature. When AIC is enabled, the overall bandwidth capacity of the sensor is
reduced.
AIC policy enforcement is disabled in the IPS default configuration. If you want to activate AIC policy
enforcement, we highly recommend that you carefully choose the exact policies of interest an d disable
those you do not need. Also, if your sensor is near its maximum inspectio n load capacity, we recommend
that you not use this feature since it can oversubscribe the sensor. We recommend that you use the
adaptive security appliance firewall to handle this type of policy enforcement.
Configuring the Application Policy
Use the application-policy command in signature definition submode to enable the web AIC feature.
You can configure the sensor to provide Layer4 to Layer 7 packet inspection to prevent malicious
attacks related to web and FTP services.