Chapter 4 Zone Configuration
Zone Traffic Learning
To create a new zone with interactive recommendations mode perform the following:
1.From the Configuration command group level type the following:
2.Choose ENTER.
The new zone is created with a DEFAULT zone template configured for interactive recommendations mode. See the “Defining a New Zone” section for further details.
Deactivating the Interactive Recommendation Mode
The user may deactivate the interactive recommendations mode for any desired zone or zones at any time. Deactivating this mode results in the Detector disregarding any recommendations and assuming an automatic detection functioning such as automatically producing dynamic filters, etc. The user may deactivate the interactive recommendations mode from the desired zone’s command group level.
To deactivate the interactive recommendation mode perform the following:
1.Type the following (sample):
2.Choose ENTER.
Zone Traffic Learning
As the user initializes the Learning phase (see the “Learning Phase 1 – Policy Construction” section in this chapter), the Detector learns the zone’s (zones’) traffic characteristics. The results of this stage will be translated into detection policies. The Learning system constructs the Detector detection policies that instruct the Detector detection system as for how to regard the zone traffic flows.
Note For the learning phases to take place port mirroring must be configured on the switch or the Detector must be connected to a router using an optical splitter.
| Cisco Traffic Anomaly Detector User Guide |
|
