7-23
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
78-16527-01
Chapter 7 Defining Signatures
Configuring Signatures
Step 3
Specify the IP fragment reassembly signature ID and subsignature ID:
sensor(config-sig)#
signatures 1200 0
Step 4
Specify the engine:
sensor(config-sig-sig)#
engine normalizer
Step 5
Enter edit default signatures submode:
sensor(config-sig-sig-nor)#
edit-default-sigs-only default-signatures-only
Step 6
Enable and change the default setting (if desired) of the one IP fragment reassembly parameter for
signature 1200:
sensor(config-sig-sig-nor-def)#
specify-max-fragments yes
sensor(config-sig-sig-nor-def-yes)#
max-fragments 20000
Step 7
Verify the settings:
sensor(config-sig-sig-nor-def-yes)#
show settings
yes
-----------------------------------------------
max-fragments: 20000 default: 10000
-----------------------------------------------
sensor(config-sig-sig-nor-def-yes)#
Step 8
Exit signature definition submode:
sensor(config-sig-sig-nor-def-yes)#
exit
sensor(config-sig-sig-nor-def)#
exit
sensor(config-sig-sig-nor)#
exit
sensor(config-sig-sig)#
exit
sensor(config-sig)#
exit
Apply Changes:?[yes]:
Step 9
Press
Enter
for apply the changes or type
no
to discard them.
Configuring the Method for IP Fragment Reassembly
Use the
fragment-reassembly
command in the signature definition submode to configure the method
the sensor will use to reassemble fragments. You can configure this option if your sensor is operating in
promiscuous mode. If your sensor is operating in line mode, the method is NT only.
The following options apply:
•
ip-reassemble-mode
—Identifies the method the sensor uses to reassemble the fragments based on
the operating system.
–
nt
—Windows systems.
–
solaris
—Solaris systems.
–
linux
—GNU/Linux systems.
–
bsd
—BSD UNIX systems.
The default is nt.
