CHAPT ER
9-1
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
9
Configuring Anomaly Detection
This chapter describes anomaly detection (AD) and its features and how to configure them. This chapter
contains the following topics:
•
Anomaly Detection Notes and Caveats, page 9-1
•
Understanding Security Policies, page 9-2
•
Understanding Anomaly Detection, page 9-2
•
Understanding Worms, page 9-2
•
Anomaly Detection Modes, page9-3
•
Anomaly Detection Zones, page 9-4
•
Anomaly Detection Configuration Sequence, page 9-5
•
Anomaly Detection Signatures, page 9-6
•
Enabling Anomaly Detection, page9-8
•
Working With Anomaly Detection Policies, page 9-8
•
Configuring Anomaly Detection Operational Settings, page 9-10
•
Configuring the Internal Zone, page 9-11
•
Configuring the Illegal Zone, page 9-20
•
Configuring the External Zone, page 9-28
•
Configuring Learning Accept Mode, page 9-36
•
Working With KB Files, page 9-40
•
Displaying Anomaly Detection Statistics, page 9-47
•
Disabling Anomaly Detection, page 9-48

Anomaly Detection Notes and Caveats

The following notes and caveats apply to configuring anomaly detection:
•
Anomaly detection is disabled by default. You must enable it to configure or apply an anomaly
detection policy. Enabling anomaly detection results in a decrease in performance.
•
Anomaly detection assumes it gets traffic from both directions. If the sensor is configured to see
only one direction of traffic, you should turn off anomaly detection. Otherwise, w hen anomaly
detection is running in an asymmetric environment, it identifies all traffic as having incomplete