Filter
Top Products
9-12
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 9 Configuring Anomaly Detection
Configuring the Internal Zone
Step 9 Press Enter to apply your changes or enter no to discard them.
Configuring the Internal Zone
This section describes how to configure the internal zone, and contains the following topics:
• Understanding the Internal Zone, page 9-12
• Configuring the Internal Zone, page 9-12
• Configuring TCP Protocol for the Internal Zone, page 9-13
• Configuring UDP Protocol for the Internal Zone, page 9-16
• Configuring Other Protocols for the Internal Zone, page 9-18
Understanding the Internal Zone
The internal zone should represent your internal network. It should receive all the traffic that comes to
your IP address range. If the zone is disabled, packets to this zone are ignored. By default the zone is
enabled. You then add the IP addresses that belong to this zone. If you do not configure IP addresses for
all zones, all packets are sent to the default zone, the external zone.
You can enable or disable TCP, UDP, and other protocols for the internal zone. You can configure a
destination port for the TCP and UDP protocols and a protocol number for the other protocols. You can
either use the default thresholds or override the scanner settings and add your own thresholds and
histograms.
Configuring the Internal Zone
Use the internal-zone {enabled | ip-address-range | tcp | udp |other} command in service
anomaly-detection submode to enable the internal zone, add IP addresses to the internal zone, and
specify protocols.
The following options apply:
• enabled {false | true}—Enables/disables the zone.
• ip-address-range—Specifies the IP addresses of the subnets in the zone. The valid value is
<A.B.C.D>-<A.B.C.D>[,<A.B.C.D>-<A.B.C.D>].
Note The second IP address in the range must be greater than or equal to the first IP address.
• tcp—Lets you configure TCP protocol.
• udp—Lets you configure UDP protocol.
• other—Lets you configure other protocols besides TCP and UDP.