Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 174

Understanding Blocking
Note
Note
Network block—Blocks all traffic from a given network.
•
Note
Do not confuse blocking with the sensor's ability to drop packets. The sensor can drop packets when the
Note
following actions are configured for a sensor in inline mode: deny packet inline, deny connection inline,
and deny attacker inline.
On Cisco routers and Catalyst 6500 series switches, Network Access Controller creates blocks by
applying ACLs or VACLs. ACLs and VACLs permit or deny passage of data packets through interface
ports or VLANs. Each ACL or VACL contains permit and deny conditions that apply to IP addresses.
The PIX Firewall, FWSM, and ASA do not use ACLs or VACLs. The built-in shun/no shun command
is used.
You need the following information for Network Access Controller to manage a device:
Login user ID (if the device is configured with AAA)
•
• Login password
• Enable password (not needed if the user has enable privileges)
• Interfaces to be managed (for example, ethernet0, vlan100)
Any existing ACL/VACL information you want applied at the beginning (Pre-Block ACL/VACL) or
•
end (Post-Block ACL/VACL) of the ACL/VACL that will be created
This does not apply to a PIX Firewall, FWSM, or ASA because they do not use ACLs to block.
• Whether you are using Telnet or SSH to communicate with the device
IP addresses (host or range of hosts) you never want blocked
•
How long you want the blocks to last
•
To check the status of Network Access Controller, type show statistics network-access at the
Tip
The output shows the devices you are managing, any active blocks, and the status for all devices. In the
IDM, click Monitoring > Statistics, or in the ASDM, click Monitoring > Features > IPS > Statistics,
to see the status of Network Access Controller.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
10-2
Connection blocks are not supported on firewalls. Firewalls only support host blocks with
additional connection information.
Multiple connection blocks from the same source IP address to either a different destination
IP address or destination port automatically switch the block from a connection block to a
host block.
You can initiate host and connection blocks manually or automatically when a signature is
triggered. You can only initiate network blocks manually.
Chapter 10 Configuring Blocking
sensor#
78-16527-01
.