Blocking Not Occurring For A Signature - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Appendix C Troubleshooting

Blocking Not Occurring for a Signature

If blocking is not occurring for a specific signature, check that the event action is set to block the host.
To make sure blocking is occurring for a specific signature, follow these steps:
Log in to the CLI.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
sensor(config-sig)#
Make sure the event action is set to block the host:
Step 3
Note
sensor(config-sig)# signatures 1300 0
sensor(config-sig-sig)# engine normalizer
sensor(config-sig-sig-nor)# event-action produce-alert|request-block-host
sensor(config-sig-sig-nor)# show settings
normalizer
-----------------------------------------------
-connection-inline
--MORE--
Exit signature definition submode:
Step 4
sensor(config-sig-sig-nor)# exit
sensor(config-sig-sig)# exit
sensor(config-sig)# exit
Apply Changes:?[yes]:
Step 5 Press Enter to apply the changes or type
78-16527-01
If you want to receive alerts, you must always add produce-alert any time you configure the
event actions.
event-action: produce-alert|request-block-host default: produce-alert|deny
edit-default-sigs-only
-----------------------------------------------
default-signatures-only
-----------------------------------------------
specify-service-ports
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
specify-tcp-max-mss
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
specify-tcp-min-mss
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Troubleshooting the 4200 Series Appliance
to discard them.
no
C-21