Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 194

Configuring Blocking Devices
You create and save Pre-Block and Post-Block VACLs in your switch configuration. These VACLs must
be extended IP VACLs, either named or numbered. See your switch documentation for more information
on creating VACLs.
Enter the names of these VACLs that are already configured on your switch in the Pre-Block VACL and
Post-Block VACL fields.
The Pre-Block VACL is used mainly for permitting what you do not want the sensor to ever block. When
a packet is checked against the VACL, the first line that gets matched determines the action. If the first
line matched is a permit line from the Pre-Block VACL, the packet is permitted even though there may
be a deny line (from an automatic block) listed later in the VACL. The Pre-Block VACL can override the
deny lines resulting from the blocks.
The Post-Block VACL is best used for additional blocking or permitting that you want to occur on the
same VLAN. If you have an existing VACL on the VLAN that the sensor will manage, the existing VACL
can be used as a Post-Block VACL. If you do not have a Post-Block V ACL, the sensor inserts a permit
ip any any at the end of the new VACL.
The IDSM-2 inserts a permit ip any any capture at the end of the new VACL.
Note
When the sensor starts up, it reads the contents of the two VACLs. It creates a third VACL with the
following entries:
•
•
•
•
The sensor applies the new VACL to the VLAN that you designate
Note When the new VACL is applied to a VLAN of the switch, it removes the application of any other VACL
to that VLAN.
Configuring the Sensor to Manage Catalyst 6500 Series Switches and Cisco 7600 Series Routers
To configure the sensor to manage Catalyst 6500 series switches and Cisco 7600 series routers, follow
these steps:
Log in to the CLI using an account with administrator privileges.
Step 1
Step 2 Enter network access submode:
sensor# configure terminal
Step 3 Set the IP address for the router controlled by Network Access Controller:
sensor(config-net)# cat6k-devices ip_address
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
10-22
A permit line for the sensor's IP address
Copies of all configuration lines of the Pre-Block VACL
A deny line for each address being blocked by the sensor
Copies of all configuration lines of the Post-Block VACL
Chapter 10 Configuring Blocking
78-16527-01