Filter
Top Products
9-13
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 9 Configuring Anomaly Detection
Configuring the Internal Zone
Configuring the Internal Zone
To configure the internal zone, follow these steps:
Step 1 Log in to the CLI using an account with administrator privileges.
Step 2 Enter anomaly detection internal zone submode.
sensor# configure terminal
sensor(config)# service anomaly-detection ad0
sensor(config-ano)# internal-zone
sensor(config-ano-int)#
Step 3 Enable the internal zone.
sensor(config-ano-int)# enabled true
Step 4 Configure the IP addresses to be included in the internal zone.
sensor(config-ano-int)# ip-address-range 192.0.2.72-192.0.2.108
Step 5 Configure TCP protocol.
Step 6 Configure UDP protocol.
Step 7 Configure the other protocols.
For More Information
• For the procedure for configuring TCP protocol, see Configuring TCP Protocol for the Internal
Zone, page 9-13.
• For the procedure for configuring UDP protocol, see Configuring UDP Protocol for the Internal
Zone, page 9-16.
• For the procedure for configuring other protocols, see Configuring Other Protocols for the Internal
Zone, page 9-18.
Configuring TCP Protocol for the Internal Zone
Use the tcp {enabled | dst-port number | default-thresholds} command in service anomaly detection
internal zone submode to enable and configure the TCP service. The following options apply:
• enabled {false | true}—Enables/disables TCP protocol.
• default-thresholds—Defines thresholds to be used for all ports not specified in the destination port
map:
–
threshold-histogram {low | medium | high} num-source-ips number—Sets values in the
threshold histogram.
–
scanner-threshold—Sets the scanner threshold. The default is 200.
• dst-port number—Defines thresholds for specific destination ports. The valid values are 0 to 65535.
• enabled {true | false}—Enables/disables the service.
• override-scanner-settings {yes | no}—Lets you override the scanner values:
–
threshold-histogram {low | medium | high} num-source-ips number—Sets values in the
threshold histogram.