14-26
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter14 Co nfiguring Attack Response Controller for Blocking and Rate Limiting
Configuring Blocking and Rate Limiting Devices
The Post-Block VACL is best used for additional blocking or permitting that you want to occur on the
same VLAN. If you have an existing VACL on the VLAN that the sensor will manage, the existing VACL
can be used as a Post-Block VACL. If you do not have a Post-Block V ACL, the sensor inserts permit
ip any any at the end of the new VACL.
When the sensor starts up, it reads the contents of the two VACLs. It creates a third VACL with the
following entries:
•
A permit line for the sensor IP address
•
Copies of all configuration lines of the Pre-Block VACL
•
A deny line for each address being blocked by the sensor
•
Copies of all configuration lines of the Post-Block VACL
The sensor applies the new VACL to the VLAN that you designate.
Note
When the new VACL is applied to a VLAN of the switch, it removes the application of any other VACL
to that VLAN.
For More Information
For the procedure for configuring blocking using router ACLs, see Configuring Blocking and Rate
Limiting Devices, page 14-21.
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers
To configure the sensor to manage Catalyst 6500 series switches and Cisco 7600 series routers, follow
these steps:
Step 1
Log in to the CLI using an account with administrator privileges.
Step 2
Enter network access submode.
sensor# configure terminal
sensor(config)# service network-access
sensor(config-net)#
Step 3
Specify the IP address for the router controlled by the ARC.
sensor(config-net)# cat6k-devices ip_address
Step 4
Enter the user profile name that you created when you configured the user profile. The ARC accepts
anything you type. It does not accept it, check to see if the logical device exists.
sensor(config-net-cat)# profile-name user_profile_name
Step 5
Specify the method used to access the sensor. If unspecified, SSH 3DES is used.
sensor(config-net-cat)# communication {telnet | ssh-3des}
Note
If you are using 3DES, you must use the command ssh host-key ip_address to accept the key or
ARC cannot connect to the device.
Step 6
Specify the sensor NAT address.
sensor(config-net-cat)# nat-address nat_address