Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Exclude an IP being blocked on a signature

Dear All,

In our AIP-SSM 20  signature 11020/0 1 /2/3 & 4 are configured to be denied.

Is there any way we can exclude 01 IP from being denied by this signature? 

Any reponse would be appreciated.

Thanks

2 REPLIES
New Member

Exclude an IP being blocked on a signature

You will need to create an event action filter "service event-action-rules rules0" section of the CLI or through the GUI you can click on Configuration\Policies\Event Action Rules\rules0, click on the Event Action Filters tab on the right.  Create a filter for the source or destination IP address, specify the signature(s) you want to filter on, and then select the actions to remove, such as create alert or drop packet.

Jon.

New Member

Exclude an IP being blocked on a signature

True JonPBerbee,

Here is further readup to corroborate...

http://popravak.wordpress.com/2012/04/30/event-action-filters/

Daniel.

237
Views
8
Helpful
2
Replies
CreatePlease login to create content