Filter
Top Products
B-16
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix B Signature Engines
Atomic Engine
Only the outermost IP tunnel is identified. When an IPv6 tunnel or IPv6 traffic inside of an IPv4 tunnel
is detected, a signature fires an alert. All of the other IPv6 traffic in embedded tunnels is not inspected.
The following tunneling methods are supported, but not individually detected. For example, ISATAP,
6to4, and manual IPv6 RFC 4213 tunnels all appear as IPv6 in IPv4, which is detected by signature 1007:
• ISATAP
• 6to4 (RFC 3056)
• Manually configured tunnels (RFC 4213)
• IPv6 over GRE
• Teredo (IPv6) inside UDP
• MPLS (unencrypted)
• IPv6 over IPv6
IPv6 supports the following:
• Denying by source IP address, destination IP address, or IP address pair
• Alerts
• Resetting the TCP connection
• Logging
Atomic IP Advanced Engine Restrictions
The Atomic IP Advanced engine contains the following restrictions:
• Cannot detect the Layer 4 field of the packets if the packets are fragmented so that the Layer 4
identifier does not appear in the first packet.
• Cannot detect Layer 4 attacks in flows with packets that are fragmented by IPv6 because there is no
fragment reassembly.
• Cannot detect attacks with tunneled flows.
• Limited checks are provided for the fragmentation header.
• There is no support for IPv6 on the management (command and control) interface. With
ASA 8.2(1), the ASA 5500 AIP SSM support IPv6 features.
• If there are illegal duplicate headers, a signature fires, but the individual headers cannot be
separately inspected.
• Anomaly detection does not support IPv6 traffic; only IPv4 traffic is directed to the anomaly
detection processor.
• Rate limiting and blocking are not supported for IPv6 traffic. If a signature is configured with a
block or rate limit event action and is triggered by IPv6 traffic, an alert is generated but the action
is not carried out.