14-28
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter14 Co nfiguring Attack Response Controller for Blocking and Rate Limiting
Configuring the Sensor to be a Master Blocking Sensor
Note
If you are using 3DES, you must use the command ssh host-key ip_address to accept the key or
the ARC cannot connect to the device.
Step 6
Specify the sensor NAT address.
sensor(config-net-fir)# nat-address nat_address
Note
This changes the IP address in the first line of the ACL from the IP address of the sensor to the
NAT address. This is not a NAT address configured on the device being managed. It is the
address the sensor is translated to by an intermediate device, one that is between the sensor and
the device being managed.
Step 7
Exit network access submode.
sensor(config-net-fir)# exit
sensor(config-net)# exit
sensor(config)# exit
Apply Changes:?[yes]:
Step 8
Press Enter to apply the changes or enter
no
to discard them.
For More Information
•
For the procedure for configuring user profiles, see Configuring User Profiles, page14-20.
•
For the procedure for adding a device to the known hosts list, see Adding Hosts to the SSH Known
Hosts List, page 3-46.
Configuring the Sensor to be a Master Blocking Sensor
Multiple sensors (blocking forwarding sensors) can forward blocking requests to a specified master
blocking sensor, which controls one or more devices. The master blocking sensor is the ARC running on
a sensor that controls blocking on one or more devices on behalf of one or more other sensors. The ARC
on a master blocking sensor controls blocking on devices at the request of the ARCs running on other
sensors. Master blocking sensors can also forward rate limits.
Caution
Two sensors cannot control blocking or rate limiting on the same device. If this situation is needed,
configure one sensor as the master blocking sensor to manage the devices and the other sensors can
forward their requests to the master blocking sensor.
When you add a master blocking sensor, you reduce the number of blocking devices per sensor. For
example, if you want to block on 10 firewalls and 10 routers with one blocking interface/direction each,
you can assign 10 to the sensor and assign the other 10 to a master blocking sensor.
On the blocking forwarding sensor, identify which remote host serves as the master blocking sensor; on
the master blocking sensor you must add the blocking forwarding sensors to its access list.