IPS white list and virus signatures drop

[edgar-quintana]

Hi,

Two questions:

1º Is good to drop all high virus signatures?

2º IPS is activated to inside interface, this interface supports vpn conection.

There is activated drop icmp attacks, but sometimes, packets from VPN are dropped.

Is possible to add/create a white list with vpn /lan ip addresses to exclude them from the analisis/drop?

Best regards

[rhermes]

To answer your second question, you can exclude actions from a particular host with an Event Action Filter. If you're running 6.0 and use the CLI, this is what you'd want to read:

http://cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a00807517b6.html#wp1030749

[edgar-quintana]

I use 2821 cisco router