Exclude an IP being blocked on a signature

[Shibu1978]

Dear All,

In our AIP-SSM 20  signature 11020/0 1 /2/3 & 4 are configured to be denied.

Is there any way we can exclude 01 IP from being denied by this signature? 

Any reponse would be appreciated.

Thanks

[JonPBerbee]

You will need to create an event action filter "service event-action-rules rules0" section of the CLI or through the GUI you can click on Configuration\Policies\Event Action Rules\rules0, click on the Event Action Filters tab on the right.  Create a filter for the source or destination IP address, specify the signature(s) you want to filter on, and then select the actions to remove, such as create alert or drop packet.

Jon.

[dadaramola]

True JonPBerbee,

Here is further readup to corroborate...

http://popravak.wordpress.com/2012/04/30/event-action-filters/

Daniel.