Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

exclude destination address from sig

New to Cisco IPS....

I wish to EXCLUDE a single destination IP address from a signature -- have the sig fire it it trips for all BUT one IP address (which is a confirmed false positive).

The sig name is BO2K-UDP. want to have it ignore events for a single destination but have it trip normally for all other destinations. Thanks.

2 REPLIES
Gold

Re: exclude destination address from sig

You want to set up an Event Action Filter.

Here's the 6.0 version:

http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliEvAct.html

New Member

Re: exclude destination address from sig

thank you for for your quick reply... must this be done via CLI or can it be done in the GUI? Thanks.

134
Views
0
Helpful
2
Replies