cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
448
Views
0
Helpful
2
Replies

Combine IDS/IPS Policy to Drop All but Allow Certain IP with given ID

nreis_srn
Level 1
Level 1

Is it possible, for example, to allow SQL inject testing for our web app scanner and at the same time deny all others, to create a custom rule for just that particular sig?

This would allow us to really ratchet down our systems utilizing the web app scanner, but at the same time max-protect for all other potential attackers.

TIA

1 Accepted Solution

Accepted Solutions

roshan.maskey
Level 1
Level 1

Hi,

It is possible for your IP from being denied or producing alert while other IPs will follow your normal rules.

For that please follow the following procedure.

1. Goto-IDM-EventActionRules-Rule0

2. Click on tab EventActionFilter (third tab)

3. Click Add and set the following information:

a. SigID: Specify your particular or leave default

b. SubSigID: your sigID or leave default

c. AttackerAddress: your Computer IP

d. AtaackerPort: leave default

e. Victim Address: Your Server IP or leave default

f. VictimPort: leave default

g. RiskRating leave default

h. Action to Subtract: Select the Signature You don't want to fire or can select all.

[press and hold and click for multiple select Signature]

Reset leave default.

4. Click Ok

5. Click Apply

Doing this your ip will not produce alter while doing your PenTest.

View solution in original post

2 Replies 2

roshan.maskey
Level 1
Level 1

Hi,

It is possible for your IP from being denied or producing alert while other IPs will follow your normal rules.

For that please follow the following procedure.

1. Goto-IDM-EventActionRules-Rule0

2. Click on tab EventActionFilter (third tab)

3. Click Add and set the following information:

a. SigID: Specify your particular or leave default

b. SubSigID: your sigID or leave default

c. AttackerAddress: your Computer IP

d. AtaackerPort: leave default

e. Victim Address: Your Server IP or leave default

f. VictimPort: leave default

g. RiskRating leave default

h. Action to Subtract: Select the Signature You don't want to fire or can select all.

[press and hold and click for multiple select Signature]

Reset leave default.

4. Click Ok

5. Click Apply

Doing this your ip will not produce alter while doing your PenTest.

Thank you kindly

Review Cisco Networking products for a $25 gift card