Cisco Systems IPS4510K9 manual Monitoring and Clearing the Denied Attackers List

Chapter 8 Configuring Event Action Rules

Configuring the Denied Attackers List

Adding Entries to the Denied Attacker List

To add a deny attacker entry to the list of denied attackers, follow these steps:

Step 1 Log in to the CLI using an account with administrator or operator privileges.

Step 2 Add a deny attacker entry with an IP address of 192.0.2.0.

sensor# deny attacker ip-address 192.0.2.0

Warning: Executing this command will add deny attacker address on all virtual sensors. Continue? [yes]:

Step 3 Enter yes to add this deny attacker entry for all virtual sensors.

Step 4 Add a deny attacker entry to a specific virtual sensor.

sensor# deny attacker virtual-sensor vs0 ip-address 192.0.2.0

Step 5 Remove the deny attacker entry from the list.

sensor# no deny attacker ip-address 10.1.1.1

Warning: Executing this command will delete this address from the list of attackers being denied by all virtual sensors.

Continue? [yes]:

Step 6 Enter yes to remove the deny attacker entry from the list.

Note To immediately stop denying attackers, you must use the clear denied-attackerscommand to clear the denied attackers list.

For More Information

For the procedure for clearing denied attackers permanently from the denied attackers list, see Monitoring and Clearing the Denied Attackers List, page 8-36.

Monitoring and Clearing the Denied Attackers List

Use the show statistics denied-attackerscommand to display the list of denied attackers. Use the clear denied-attackers[virtual_sensor] [ip-addressip_address] command to delete the denied attackers list and clear the virtual sensor statistics.

If your sensor is configured to operate in inline mode, the traffic is passing through the sensor. You can configure signatures to deny packets, connections, and attackers while in inline mode, which means that single packets, connections, and specific attackers are denied, that is, not transmitted, when the sensor encounters them. When the signature fires, the attacker is denied and placed in a list. As part of sensor administration, you may want to delete the list or clear the statistics in the list.

The following options apply:

•virtual_sensor—(Optional) Specifies the virtual sensor whose denied attackers list should be cleared.

•ip_address—(Optional) Specifies the IP address to clear.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
8-36	OL-29168-01