Cisco Systems OL-4015-08 IPS Rule Wizard Summary, IPS Rules Configuration

Chapter19 Intrusion Prevention System
IPS Rules
19-34
Cisco Router and Security Device Manager Version 2.2 User’s Guide
OL-4015-08
Use the Add, Delete, Move Up, and Move Down buttons to add, remove, and
order a list of SDF locations that the router can attempt to contact to obtain an
SDF. The router starts at the first entry, and works down the list until it obtains an
SDF.
Cisco IOS images that support IOS IPS contain built-in signatures. If you check
the box at the bottom of the window, the router will use the built-in signatures only
if it cannot obtain an SDF from any location in the list.
IPS Rule Wizard Summary
The Summary window displays the information that you have entered so that you
can review it before delivering the changes to the router. Following is an example
Summary window display:
Selected Interface: FastEthernet 0/1
IPS Scanning Direction: Both
Signature Definition File Location: flash//sdmips.sdf
Built-in enabled: yes
In this example, IPS is enabled on the FastEthernet 0/1 interface, and both
inbound and outbound traffic is scanned. The SDF is named sdmips.sdf and is
located in router flash. The router is configured to use the signature definitions
built in to the Cisco IOS image that the router runs.
IPS Rules Configuration
This window displays the IPS status of all router interfaces, and allows you to
enable and disable IPS on interfaces.
Interfaces
Use this list to filter the interfaces shown in the interface list area. Select between
the following:
•All interfaces—All interfaces on the router.
•IPS interfaces—Interfaces on which IPS has been enabled.