Filter
Top Products
9-36
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Chapter 9 Configuring Anomaly Detection
Configuring the External Zone
Step 7 Add a histogram for the new scanner settings. Enter the number of destination IP addresses (low,
medium, or high) and the number of source IP addresses you want associated with this histogram.
sensor(config-ano-ext-oth-pro-yes)# threshold-histogram high num-source-ips 75
Step 8 Set the scanner threshold.
sensor(config-ano-ext-oth-pro-yes)# scanner-threshold 100
Step 9 Configure the default thresholds for all other unspecified ports.
sensor(config-ano-ext-oth-pro-yes)# exit
sensor(config-ano-ext-oth-pro)# exit
sensor(config-ano-ext-oth)# default-thresholds
sensor(config-ano-ext-oth-def)# default-thresholds
sensor(config-ano-ext-oth-def)# threshold-histogram medium num-source-ips 120
sensor(config-ano-ext-oth-def)# scanner-threshold 120
Step 10 Verify the other protocols configuration settings.
sensor(config-ano-ext-oth)# show settings
other
-----------------------------------------------
protocol-number (min: 0, max: 255, current: 1)
-----------------------------------------------
number: 5
-----------------------------------------------
override-scanner-settings
-----------------------------------------------
yes
-----------------------------------------------
scanner-threshold: 95 default: 200
threshold-histogram (min: 0, max: 3, current: 1)
-----------------------------------------------
dest-ip-bin: high
num-source-ips: 75
-----------------------------------------------
-----------------------------------------------
-----------------------------------------------
enabled: true default: true
-----------------------------------------------
-----------------------------------------------
default-thresholds
-----------------------------------------------
scanner-threshold: 200 <defaulted>
threshold-histogram (min: 0, max: 3, current: 3)
-----------------------------------------------
<protected entry>
dest-ip-bin: low <defaulted>
num-source-ips: 10 <defaulted>
<protected entry>
dest-ip-bin: medium <defaulted>
num-source-ips: 1 <defaulted>
<protected entry>
dest-ip-bin: high <defaulted>
num-source-ips: 1 <defaulted>
-----------------------------------------------
-----------------------------------------------
enabled: true default: true
-----------------------------------------------
sensor(config-ano-ext-oth)#