Filter
Top Products
9-25
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 9 Configuring Anomaly Detection
Configuring the Illegal Zone
Step 3 Enable UDP protocol.
sensor(config-ano-ill)# udp
sensor(config-ano-ill-udp)# enabled true
Step 4 Associate a specific port with UDP protocol.
sensor(config-ano-ill-udp)# dst-port 20
sensor(config-ano-ill-udp-dst)#
Step 5 Enable the service for that port.
sensor(config-ano-ill-udp-dst)# enabled true
Step 6 Override the scanner values for that port. You can use the default scanner values, or you can override
them and configure your own scanner values.
sensor(config-ano-ill-udp-dst)# override-scanner-settings yes
sensor(config-ano-ill-udp-dst-yes)#
Step 7 Add a histogram for the new scanner settings. Enter the number of destination IP addresses (low,
medium, or high) and the number of source IP addresses you want associated with this histogram.
sensor(config-ano-ill-udp-dst-yes)# threshold-histogram low num-source-ips 100
Step 8 Set the scanner threshold.
sensor(config-ano-ill-udp-dst-yes)# scanner-threshold 100
Step 9 Configure the default thresholds for all other unspecified ports.
sensor(config-ano-ill-udp-dst-yes)# exit
sensor(config-ano-ill-udp-dst)# exit
sensor(config-ano-ill-udp)# exit
sensor(config-ano-ill-udp)# default-thresholds
sensor(config-ano-ill-udp-def)# default-thresholds
sensor(config-ano-ill-udp-def)# threshold-histogram medium num-source-ips 120
sensor(config-ano-ill-udp-def)# scanner-threshold 120
Step 10 Verify the UDP configuration settings.
sensor(config-ano-ill-udp)# show settings
udp
-----------------------------------------------
dst-port (min: 0, max: 65535, current: 4)
-----------------------------------------------
number: 20
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
yes
-----------------------------------------------
scanner-threshold: 100 default: 200
threshold-histogram (min: 0, max: 3, current: 1)
-----------------------------------------------
dest-ip-bin: low
num-source-ips: 100
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
enabled: true default: true
-----------------------------------------------
number: 23
-----------------------------------------------
override-scanner-settings