Cisco Systems IPS4510K9 manual Configuring the Mode for TCP Stream Reassembly, Specify the engine

Chapter 7 Defining Signatures

Configuring Signatures

sensor# configure terminal

sensor(config)# service signature-definition sig1

Step 3 Specify the TCP stream reassembly signature ID and subsignature ID.

sensor(config-sig)# signatures 1313 0

Step 4 Specify the engine.

sensor(config-sig-sig)# engine normalizer

Step 5 Enter edit default signatures submode.

sensor(config-sig-sig-nor)#edit-default-sigs-only default-signatures-only

Step 6 Enable and change the default setting (if desired) of the maximum MSS parameter for signature 1313.

sensor(config-sig-sig-nor-def)# specify-tcp-max-mss yes sensor(config-sig-sig-nor-def-yes)# tcp-max-mss 1380

Note Changing this parameter from the default of 1460 to 1380 helps prevent fragmentation of traffic going through a VPN tunnel.

Step 7 Verify the settings.

sensor(config-sig-sig-nor-def-yes)# show settings

yes

-----------------------------------------------

tcp-max-mss: 1380 default: 1460

-----------------------------------------------

sensor(config-sig-sig-nor-def-yes)#

Step 8 Exit signature definition submode.

sensor(config-sig-sig-nor-def-yes)# exit sensor(config-sig-sig-nor-def)# exit sensor(config-sig-sig-nor)# exit sensor(config-sig-sig)# exit sensor(config-sig)# exit

Apply Changes:?[yes]:

Step 9 Press Enter for apply the changes or enter no to discard them.

Configuring the Mode for TCP Stream Reassembly

Use the stream-reassemblycommand in the signature definition submode to configure the mode that the sensor will use to reassemble TCP sessions.

Note The parameters tcp-3-way-handshake-requiredand tcp-reassembly-modeonly impact sensors inspecting traffic in promiscuous mode, not inline mode. To configure asymmetric options for sensors inspecting inline traffic, use the inline-TCP-evasion-protection-modeparameter.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		7-37