Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

IDS: At What Severity Level Does Blocking Occur?

When one configures blocking on an IDS 4210 v3.1, what severity level triggers the block?

I assume HIGH, but one must never assume.

In IDM, I haven't seen anywhere to configure this.

2 ACCEPTED SOLUTIONS

Accepted Solutions
New Member

Re: IDS: At What Severity Level Does Blocking Occur?

It's not based on the severity. You can use the block feature on a low priority alarm if you want to. You need to set it at the signature level. When you enable a signature and set its priority you also set the signature action, which includes the block function.

Hope that helps.

New Member

Re: IDS: At What Severity Level Does Blocking Occur?

I haven't seen a way to group them. I've been doing it individually.

Pete

4 REPLIES
New Member

Re: IDS: At What Severity Level Does Blocking Occur?

It's not based on the severity. You can use the block feature on a low priority alarm if you want to. You need to set it at the signature level. When you enable a signature and set its priority you also set the signature action, which includes the block function.

Hope that helps.

New Member

Re: IDS: At What Severity Level Does Blocking Occur?

>>...You need to set it at the signature level...<<

Ah yes, I see that now. I hadn't delved far enough into IDM yet.

That brings up another question: Must I configure blocking for each individual signature or can I do it for groups?

A quick glance looks like I must go through each signature and select this.

Thanks for your help.

Tony

New Member

Re: IDS: At What Severity Level Does Blocking Occur?

I haven't seen a way to group them. I've been doing it individually.

Pete

New Member

Re: IDS: At What Severity Level Does Blocking Occur?

Bummer...

Well, I get paid by the hour so...

Tony

93
Views
0
Helpful
4
Replies