Cisco TelePresence Administrator's Manual page 38

Network and system settings
3. Configure the category as required:
State: whether protection for that category is enabled or disabled.
l
Description: a free-form description of the category.
l
Trigger level and Detection window: these settings combine to define the blocking threshold for the
l
category. They specify the number of failed access attempts that must occur before the block is
triggered, and the time window in which those failures must occur.
Block duration: the period of time for which the block will remain in place.
l
4. Click Save.
Configuring exemptions
The Automated detection exemptions
Exemptions) is used to configure any IP addresses that are to be exempted always from one or more
protection categories.
To configure exempted addresses:
1. Go to System > Protection > Automated detection >
2. Click on the Address you want to configure, or click New to specify a new address.
3. Enter the Address and Prefix length to define the range of IPv4 addresses you want to exempt.
4. Select the categories from which the address is to be exempted.
5. Click Add address.
Note that if you exempt an address that is currently blocked, it will remain blocked until its block duration
expires (unless you unblock it manually via the
Managing blocked addresses
The Blocked addresses
used to manage the addresses that are currently blocked by the automated protection service:
It shows all currently blocked addresses and from which categories those addresses have been blocked.
n
You can unblock an address, or unblock an address and at the same time add it to the exemption list. Note
n
that if you want to permanently block an address, you must add it to the set of configured
If you access this page via the links on the
your chosen category. It also shows the amount of time left before an address is unblocked from that
category.
Investigating access failures and intrusions
If you need to investigate specific access failures or intrusion attempts, you can review all the relevant
triggering log messages associated with each category. To do this:
1. Go to System > Protection > Automated detection >
2. Click on the name of the category you want to investigate.
3. Click View all matching intrusion protection triggers for this category.
The system will display all the relevant events for that category. You can then search through the list of
triggering events for the relevant event details such as a user name, address or alias.
Cisco VCS Administrator Guide (X8.1.1)
page (System > Protection > Automated detection >
Blocked addresses
page (System > Protection > Automated detection > Blocked
Automated detection overview
Exemptions.
page).
page it is filtered according to
Configuration.
Intrusion protection
addresses) is
firewall rules.
Page 38 of 507