Filter
Top Products
Chapter 27 Cisco IOS IPS
Edit IPS
27-36
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Stop on Match
If you want the Cisco IOS IPS to stop when an event matches this event action
filter, click Yes. If you want the Cisco IOS IPS to evaluate matching events against
the other remaining filters, click No.
Comments
You can add comments to describe the purpose of this filter. This field is optional.
Edit IPS: Signatures
Cisco IOS IPS prevents intrusion by comparing traffic against the signatures of
known attacks. Cisco IOS images that support Cisco IOS IPS have built-in
signatures that can be used, and you can also have Cisco IOS IPS import
signatures for the router to use when examining traffic. Imported signatures are
stored in a signature definition file (SDF).
This window lets you view the configured Cisco IOS IPS signatures on the router.
You can add customized signatures, or import signatures from SDFs downloaded
from Cisco.com. You can also edit, delete, enable, and disable signatures.
Cisco IOS IPS is shipped with an SDF that contains signatures that your router
can accommodate. To learn more about the SDF shipped with Cisco IOS IPS, and
how to have Cisco IOS IPS use it, click IPS-Supplied Signature Definition Files.
Signature Tree
The signature tree enables you to filter the signature list on the right according to
the type of signature that you want to view. First choose the branch for the general
type of signature that you want to display. The signature list displays the
configured signatures for the type that you chose. If a plus (+) sign appears to the
left of the branch, there are subcategories that you can use to refine the filter. Click
the + sign to expand the branch and then choose the signature subcategory that
you want to display. If the signature list is empty, there are no configured
signatures available for that type.
For example: If you want to display all attack signatures, click the Attack branch
folder. If you want to see the subcategories that you can use to filter the display
of attack signatures, click the + sign next to the Attack folder. If you want to see
Denial of Service (DoS) signatures, click the DoS folder.