Security Services
Configuring Intrusion Prevention
Cisco ISA500 Series Integrated Security Appliances Administration Guide
274
7
NOTE:
You can block an intrusion based on the source zones or based on the
destination zones. For example, if you select the LAN and DMZ zones, IPS inspects
all traffic for the LAN and DMZ zones regardless of its source. Traffic between LAN
and DMZ is inspected once, not twice. If you select the WAN zone, IPS inspects all
traffic for the WAN zone regardless of its destination.
STEP 4
In the
IPS Signature
area, use the options below to filter the list of signatures in the
Selected Signature table. The unfiltered list includes thousands of IPS signatures
that are used to identify attacks. After selecting filters, click
Refresh
to redisplay
the Selected Signature table showing only the matching signatures.
•
Severity Level:
Choose a severity level, from highest to lowest: Critical,
High, Medium, Low, and Information.
•
Operating System Type:
Choose
All
to include all signatures regardless of
the type of operating system, or choose
Selected OS Types Only
to include
only the signatures that match the specified types of operation systems.
•
Host Type:
Choose a host type.
•
Category:
Choose
All
to include all signatures regardless of the category, or
choose
Selected Categories Only
to include only the signatures that match
the specified categories.
The Selected Signature table displays this information:
•
Name:
The name of the signature.
•
ID:
The unique identifier of the signature. To view complete details for a
signature, click the link in the ID column.
•
Severity:
The severity level of the threat that the signature can identify.
•
Category:
The category that the signature belongs to.
•
Default Action:
The default preventive action for the signature.
-
Block and Log:
Deny the request, drop the connection, and log the event
when a signature is detected by the IPS engine.
-
Log Only:
Only log the event when a signature is detected by the IPS
engine.
•
Current Action:
The current preventive action for the signature.
•
Edit Action:
Click the pencil icon to enable, disable, or set the preventive
actions for a signature. For more information, see
