Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 144

Configuring Signatures
1. Each of these subsignatures describes various reasons a TCP packet might get dropped in the normalizer. By default all of
these signatures drop packets. Each of these signatures lets you allow packets that fail these checks in the normalizer a way
to still be allowed through the IPS. By default these signatures do not produce an alert. Each of these drop reasons has an
entry in the TCP statistics.
To configure TCP stream reassembly parameters, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Specify the TCP stream reassembly signature ID and subsignature ID:
Step 3
sensor(config-sig)# signatures 1313 0
Specify the engine:
Step 4
sensor(config-sig-sig)# engine normalizer
Enter edit default signatures submode:
Step 5
sensor(config-sig-sig-nor)# edit-default-sigs-only default-signatures-only
Enable and change the default setting (if desired) of the maximum MSS parameter for signature 1313:
Step 6
sensor(config-sig-sig-nor-def)# specify-tcp-max-mss yes
sensor(config-sig-sig-nor-def-yes)# tcp-max-mss 1380
Note
Verify the settings:
Step 7
sensor(config-sig-sig-nor-def-yes)# show settings
yes
-----------------------------------------------
-----------------------------------------------
sensor(config-sig-sig-nor-def-yes)#
Exit signature definition submode:
Step 8
sensor(config-sig-sig-nor-def-yes)# exit
sensor(config-sig-sig-nor-def)# exit
sensor(config-sig-sig-nor)# exit
sensor(config-sig-sig)# exit
sensor(config-sig)# exit
Apply Changes:?[yes]:
Press Enter for apply the changes or type
Step 9
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
7-26
Changing this parameter from the default of 1460 to 1380 helps prevent fragmentation of traffic
going through a VPN tunnel.
tcp-max-mss: 1380 default: 1460
to discard them.
no
Chapter 7 Defining Signatures
78-16527-01