14-25
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter1 4 Configuring Attack Response Controller for Blocking and Rate Limiting
Configuring Blocking and Rate Limiting Devices
direction: in
-----------------------------------------------
pre-acl-name: <defaulted>
post-acl-name: <defaulted>
-----------------------------------------------
-----------------------------------------------
response-capabilities: block|rate-limit default: block
-----------------------------------------------
sensor(config-net-rou)#
Step 12
Exit network access submode.
sensor(config-net-rou)# exit
sensor(config-net)# exit
sensor(config)# exit
Apply Changes:?[yes]:
Step 13
Press Enter to apply the changes or enter
no
to discard them.
For More Information
•
For the procedure for configuring user profiles, see Configuring User Profiles, page 14-20.
•
For the procedure for adding a device to the known hosts list, see Adding Hosts to the SSH Known
Hosts List, page 3-46.
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers
This section describes how to configure the sensor to manage Cisco switches. It contains the following
topics:
•
Switches and VACLs, page 14-25
•
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers,
page 14-26

Switches and VACLs

You can configure the ARC to block using VACLs on the switch itself when running Cisco Catalyst
software, or to block using router ACLs on the MSFC or on the switch itself when running Cisco IOS
software. This section describes blocking using VACLs. You cannot configure switches that use VACLs
to perform rate limiting. You must configure the blocking interfaces on the Catalyst 6500 series switch
and specify the VLAN of traffic you want blocked.
You create and save Pre-Block and Post-Block VACLs in your switch configuration. These VACLs must
be extended IP VACLs, either named or numbered. See your switch documentation for more information
on creating VACLs. Enter the names of these VACLs that are already configured on your switch in the
Pre-Block VACL and Post-Block VACL fields.
The Pre-Block VACL is used mainly for permitting what you do not want the sensor to ever block. When
a packet is checked against the VACL, the first line that gets matched determines the action. If the first
line matched is a permit line from the Pre-Block VACL, the packet is permitted even though there may
be a deny line (from an automatic block) listed later in the VACL. The Pre-Block VACL can override the
deny lines resulting from the blocks.