Cisco Systems IPS4510K9 manual Switches and VACLs, 14-25

Chapter 14 Configuring Attack Response Controller for Blocking and Rate Limiting

Configuring Blocking and Rate Limiting Devices

direction: in

-----------------------------------------------

pre-acl-name: <defaulted>

post-acl-name: <defaulted>

-----------------------------------------------

-----------------------------------------------

response-capabilities: blockrate-limit default: block

-----------------------------------------------

sensor(config-net-rou)#

Step 12 Exit network access submode.

sensor(config-net-rou)# exit

sensor(config-net)# exit sensor(config)# exit Apply Changes:?[yes]:

Step 13 Press Enter to apply the changes or enter no to discard them.

For More Information

•For the procedure for configuring user profiles, see Configuring User Profiles, page 14-20.

•For the procedure for adding a device to the known hosts list, see Adding Hosts to the SSH Known Hosts List, page 3-46.

Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers

This section describes how to configure the sensor to manage Cisco switches. It contains the following topics:

•Switches and VACLs, page 14-25

•Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers, page 14-26

Switches and VACLs

You can configure the ARC to block using VACLs on the switch itself when running Cisco Catalyst software, or to block using router ACLs on the MSFC or on the switch itself when running Cisco IOS software. This section describes blocking using VACLs. You cannot configure switches that use VACLs to perform rate limiting. You must configure the blocking interfaces on the Catalyst 6500 series switch and specify the VLAN of traffic you want blocked.

You create and save Pre-Block and Post-Block VACLs in your switch configuration. These VACLs must be extended IP VACLs, either named or numbered. See your switch documentation for more information on creating VACLs. Enter the names of these VACLs that are already configured on your switch in the Pre-Block VACL and Post-Block VACL fields.

The Pre-Block VACL is used mainly for permitting what you do not want the sensor to ever block. When a packet is checked against the VACL, the first line that gets matched determines the action. If the first line matched is a permit line from the Pre-Block VACL, the packet is permitted even though there may be a deny line (from an automatic block) listed later in the VACL. The Pre-Block VACL can override the deny lines resulting from the blocks.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		14-25