10-10
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter10 Co nfiguring Global Correlation
Configuring Global Correlation Inspection and Reputation Filtering
For More Information
•
For the procedure for configuring global correlation features, see Configuring Global Correlation
Inspection and Reputation Filtering, page 10-10.
•
For the procedure to view sensor health metrics, see Showing Sensor Overall Health Status,
page 17-17.
•
For information on the CollaborationApp, see CollaborationApp, page A-27.
•
For more information on bypass mode, see Configuring Inline Bypass Mode, page4-33.
Configuring Global Correlation Inspection and Reputation Filtering
Caution
For automatic and global correlation updates to function, you must have either a DNS server or an HTTP
proxy server configured at all times.
The following options apply:
•
global-correlation-inspection {on | off}—Turns global corre lation inspection on or off. When
turned on, the sensor uses updates from the SensorBase network to adjust the risk rating. The default
is on.
•
global-correlation-inspection-influence {permissive | standard | aggressive}—Lets you choose
the level of global correlation inspection. The default is standard.
–
permissive—Global correlation data has little influence in the decision to deny traffic.
–
standard—Global correlation moderately influences the decision to deny traffic.
–
aggressive—Global correlation data heavily influences the decision to deny traffic.
•
reputation-filtering {on | off}—Turns reputation filtering on or off. When turned on, the sensor
denies access to malicious hosts that are listed in the global correlation database. The default is on.
•
test-global-correlation {on | off}—Enables reporting of deny actions that are affected by global
correlation. Allows you to test the global correlation features without actually denying any hosts.
The default is off.
Configuring Global Correlation
To configure global correlation features, follow these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter global correlation submode.
sensor# configure terminal
sensor(config)# service global-correlation
sensor(config-glo)#
Step 3
Turn on global correlation inspection.
sensor(config-glo)# global-correlation-inspection on
sensor(config-glo)#
Step 4
Specify the level of global correlation inspection.
sensor(config-glo)# global-correlation-inspection-influence aggressive
sensor(config-glo)#