Filter
Top Products
9-23
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 9 Configuring Anomaly Detection
Configuring the Illegal Zone
Step 8 Set the scanner threshold.
sensor(config-ano-ill-tcp-dst-yes)# scanner-threshold 100
Step 9 Configure the default thresholds for all other unspecified ports.
sensor(config-ano-ill-tcp-dst-yes)# exit
sensor(config-ano-ill-tcp-dst)# exit
sensor(config-ano-ill-tcp)# exit
sensor(config-ano-ill-tcp)# default-thresholds
sensor(config-ano-ill-tcp-def)# default-thresholds
sensor(config-ano-ill-tcp-def)# threshold-histogram medium num-source-ips 120
sensor(config-ano-ill-tcp-def)# scanner-threshold 120
Step 10 Verify the TCP configuration settings.
sensor(config-ano-ill-tcp)# show settings
tcp
-----------------------------------------------
dst-port (min: 0, max: 65535, current: 4)
-----------------------------------------------
number: 20
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
yes
-----------------------------------------------
scanner-threshold: 100 default: 200
threshold-histogram (min: 0, max: 3, current: 1)
-----------------------------------------------
dest-ip-bin: low
num-source-ips: 100
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
enabled: true default: true
-----------------------------------------------
number: 23
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
enabled: true <defaulted>
-----------------------------------------------
number: 113
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
enabled: true <defaulted>
-----------------------------------------------
number: 567
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
no
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------