blocking IP range on the IPS

johnperk · ‎02-09-2009

Is there a way to drop all traffic in one particular IP range? We have a large amount spanned to the IPS which cannot be changed, but there is one particular IP range that I don't want to monitor.

Can I drop this range at the IPS?

Thanks

rhermes · ‎02-09-2009

I think you are asking for a filter (blocking has an entreily different meaning). In this case, it's called an Event Action Filter

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_event_action_rules.html#wp1030749