Cisco Systems IPS4510K9 manual When to Disable Anomaly Detection

Appendix C Troubleshooting

When to Disable Anomaly Detection

When to Disable Anomaly Detection

If you have anomaly detection enabled and you have your sensor configured to see only one direction of traffic, you should disable anomaly detection. Otherwise, you will receive many alerts, because anomaly detection sees asymmetric traffic as having incomplete connections, that is, like worm scanners, and fires alerts.

To disable anomaly detection, follow these steps:

Step 1 Log in to the CLI using an account with administrator privileges.

Step 2 Enter analysis engine submode.

sensor# configure terminal

sensor(config)# service analysis-engine

sensor(config-ana)#

Step 3 Enter the virtual sensor name that contains the anomaly detection policy you want to disable.

sensor(config-ana)# virtual-sensor vs0 sensor(config-ana-vir)#

Step 4 Disable anomaly detection operational mode.

sensor(config-ana-vir)# anomaly-detectionsensor(config-ana-vir-ano)# operational-mode inactive sensor(config-ana-vir-ano)#

Step 5 Exit analysis engine submode.

sensor(config-ana-vir-ano)# exit sensor(config-ana-vir)# exit sensor(config-ana-)# exit Apply Changes:?[yes]:

Step 6 Press Enter to apply your changes or enter no to discard them.

For More Information

To learn more about Worms, see Understanding Worms, page 9-2.

	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		C-19