14-4
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter14 Co nfiguring Attack Response Controller for Blocking and Rate Limiting
Understanding Rate Limiting
•
How long you want the blocks to last.
Tip
To check the status of the ARC, type show statistics network-access at the
sensor#
. The output shows
the devices you are managing, any active blocks and rate limits, and the status of all devices..
Note
Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a block or
rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action is not carried
out.
For More Information
•
For the procedure to add request-block-host or request-block-conne ction event actions to a
signature, see Assigning Actions to Signatures, page 7-15.
•
For the procedure for configuring overrides that add the request-block-host or
request-block-connection event actions to alerts of a specific risk rating, see Adding, Editing,
Enabling, and Disabling Event Action Overrides, page8-17.
•
For more information on Pre- and Post-Block ACLs, see How the Sensor Manages Devices,
page 14-21.
Understanding Rate Limiting
The ARC is responsible for rate limiting traffic in protected networks. Rate limiting lets sensors restrict
the rate of specified traffic classes on network devices. Rate limit responses are supported for the Host
Flood and Net Flood engines, and the TCP half-open SYN signature. The ARC can configure rate limits
on network devices running Cisco IOS 12.3 or later. Master blocking sensors can also forward rate limit
requests to blocking forwarding sensors.
To add a rate limit, you specify the following:
•
Source address and/or destination address for any rate limit
•
Source port and/or destination port for rate limits with TCP or UDP protocol
You can also tune rate limiting signatures. You must also set the action to request-rate-limit and set the
percentage for these signatures.
Note
Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a block or
rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action is not carried
out.
Table 14-1 lists the supported rate limiting signatures and parameters.
Table14-1 Rate Limiting Si gnatures
Signature ID Signature Name Protocol
Destination IP
Address Allowed Data
2152 ICMP Flood Host ICM P Yes echo- request
2153 ICMP Smurf Attack ICMP Yes echo-reply