7-30
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter 7 Defining Signatures
Configuring Signatures
Configuring IP Fragment Reassembly Parameters
To configure IP fragment reassembly parameters for a specific signature, follow these steps:
Step 1
Log in to the CLI using an account with administrator or operator privileges.
Step 2
Enter signature definition submode.
sensor# configure terminal
sensor(config)# service signature-definition sig1
Step 3
Specify the IP fragment reassembly signature ID and subsignature ID.
sensor(config-sig)# signatures 1200 0
Step 4
Specify the engine.
sensor(config-sig-sig)# engine normalizer
Step 5
Enter edit default signatures submode.
sensor(config-sig-sig-nor)# edit-default-sigs-only default-signatures-only
Step 6
Enable and change the default setting (if desired) of any of the IP fragment re assembly parameter for
signature 1200, for example, specifying the maximum fragments.
sensor(config-sig-sig-nor-def)# specify-max-fragments yes
sensor(config-sig-sig-nor-def-yes)# max-fragments 20000
Step 7
Verify the settings.
sensor(config-sig-sig-nor-def-yes)# show settings
yes
-----------------------------------------------
max-fragments: 20000 default: 10000
-----------------------------------------------
sensor(config-sig-sig-nor-def-yes)#
Step 8
Exit signature definition submode.
sensor(config-sig-sig-nor-def-yes)# exit
sensor(config-sig-sig-nor-def)# exit
sensor(config-sig-sig-nor)# exit
sensor(config-sig-sig)# exit
sensor(config-sig)# exit
Apply Changes:?[yes]:
Step 9
Press Enter for apply the changes or enter
no
to discard them.
Configuring the Method for IP Fragment Reassembly
Use the fragment-reassembly command in the signature definition submode to configure the method
the sensor will use to reassemble fragments. You can configure this option if your sensor is operating in
promiscuous mode. If your sensor is operating in line mode, the meth od is NT only.
The following options apply:
•
ip-reassemble-mode—Identifies the method the sensor uses to reassemble the fragments based on
the operating system:
–
nt—Specifies the Windows systems (default).