8-28
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter8 Configuring Event Action Rules
Configuring OS Identifications
Adding, Editing, Deleting, and Moving Configured OS Maps
Use the os-identifications command in the service event action rules submode to configure OS host
mappings, which take precedence over learned OS mappings. You can add, edit, and delete configured
OS maps. You can move them up and down in the list to change the order in which the sensor computes
the attack relevance rating and risk rating for that particular IP addres s and OS type combination.
You can also move them up and down in the list to change the order in which the sensor resolves the OS
associated with a particular IP address. Configured OS mappings allow for ranges, so for network
192.168.1.0/24 an administrator might define the following(Ta ble 8-1 ):
More specific mappings should be at the beginning of the list. Overlap in the IP address range sets is
allowed, but the entry closest to the beginning of the list takes precedence.
The following options apply:
•
calc-arr-for-ip-range—Calculates the attack relevance rating for victims in this range. The value is
<A.B.C.D>-<A.B.C.D>[,<A.B.C.D>-<A.B.C.D>], for example,
10.20.1.0-10.20.1.255,10.20.5.0-10.20.5.255).
Note
The second IP address in the range must be greater than or equal to the first IP address.
•
configured-os-map {edit | insert | move] name1[begin | end | inactive | before | after}—Specifies
a collection of administrator-defined mappings of IP addresses to OS IDs (configured OS mappings
take precedence over imported and learned OS mappings).
•
ip—Specifies the host IP address (or addresses) running the specified OS. The value is
<A.B.C.D>-<A.B.C.D>[,<A.B.C.D>-<A.B.C.D>], for example,
10.20.1.0-10.20.1.255,10.20.5.0-10.20.5.255.
Note
The second IP address in the range must be greater than or equal to the first IP address.
•
os—Specifies the OS type the host (or hosts) is running:
–
general-os—All OS types
–
ios—Variants of Cisco IOS
–
mac-os—Variants of the Apple System OS prior to OS X
–
netware—Netware
–
other —Any Other OS
–
unix—Variants of UNIX
–
aix—Variants of AIX
–
bsd—Variants of BSD
Table8-1 Example Configured OS Mapping
IP Address Range Set OS
192.168.1.1 IOS
192.168.1.2-192.168.1.10,192.168.1.25 UNIX
192.168.1.1-192.168.1.255 Windows