how to change the default servcie port number to be checked for the IPS sig

mahmoud.yasin · ‎07-27-2009

Dear

i have an AIP-SSM (IPS) installed in a an ASA firewall.

i have configured an access-list in the firewall to forward the traffic coming from the internet toward the internal server to be checked by the IPS module.

but the case is that the services have to be checked is not the default services port numbers.

http port is 8081

oracle port is 2006

and many other services.

the question now, is how to change the default service number in the IPS in order to be checked by the corresponding service signatures?

Thanks

rhermes · ‎07-27-2009

You would set those as part of the signature variables.

http://www.cisco.com/en/US/docs/security/ips/6.1/configuration/guide/cli/cli_signature_definitions.html#wp1040009

mahmoud.yasin · ‎07-27-2009

Dear Sir

thank you for your reply.

but can i use the signature variables to add a variable ports for other services than WEB Ports.

i mean that i want to add a variable service for another remote desktop port (5555). is this possible?

Thanks

rhermes · ‎07-28-2009

If you can't set a variable for the RDP port number, then your alternative is to copy the existing RDP signatures to custom (60000 and above) signatures and change the port number on them.