Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 192

Configuring Blocking Devices
The Post-Block ACL is best used for additional blocking or permitting that you want to occur on the
same interface or direction. If you have an existing ACL on the interface or direction that the sensor will
manage, that existing ACL can be used as a Post-Block ACL. If you do not have a Post-Block ACL, the
sensor inserts a permit ip any any at the end of the new ACL.
When the sensor starts up, it reads the contents of the two ACLs. It creates a third ACL with the
following entries:
•
•
•
•
The sensor applies the new ACL to the interface and direction that you designate.
Note When the new ACL is applied to an interface or direction of the router, it removes the application of any
other ACL to that interface or direction.
Configuring the Sensor to Manage Cisco Routers
To configure a sensor to manage Cisco routers, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Enter network access submode:
Step 2
sensor# configure terminal
sensor(config)# service network-access
Set the IP address for the router controlled by Network Access Controller:
Step 3
sensor(config-net)# router-devices ip_address
Type the logical device name that you created in
Step 4
sensor(config-net-rou)# profile-name user_profile_name
Network Access Controller accepts anything you type. It does not check to see if the user profile exists.
Step 5 Designate the method used to access the sensor:
sensor(config-net-rou)# communication [telnet | ssh-des | sh-3des]
If unspecified, SSH 3DES is used.
Note
Step 6 Specify the sensor's NAT address:
sensor(config-net-rou)# nat-address nat_address
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
10-20
A permit line for the sensor's IP address
Copies of all configuration lines of the Pre-Block ACL
A deny line for each address being blocked by the sensor
Copies of all configuration lines of the Post-Block ACL
If you are using DES or 3DES, you must use the command ssh host-key ip_address to accept
the key or Network Access Controller cannot connect to the device.
Chapter 10
Configuring User Profiles, page
Configuring Blocking
10-17.
78-16527-01