Alcatel-Lucent OmniAccess 700, Руководство по настройке CLI

Страница: 851 / 1193

IDS Configuration
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
825
Alcatel-Lucent
Beta Beta
CLI Configuration Guide
T
O
E
NABLE
/D
ISABLE
S
NORT
R
ULE
E
XAMPLE
To enable Snort rule:
ALU(config-firewall-intrusion-snort)# rule enable classtype
attempted-dos
To disable Snort rule:
ALU(config-firewall-intrusion-snort)# rule disable classtype
attempted-dos
T
O
M
ODIFY
S
NORT
R
ULE
E
XAMPLE
To modify the rule given below, use the rule modify command:
Original rule:
alert tcp $ HOME_NET any -> $EXTERNAL_NET any (msg:"ATTACK-
RESPONSES directory listing"; flow:from_server,established;
content:"Volume Serial Number"; classtype:bad-unknown;
sid:1292; rev:8;)
Modification of rule to $EXTERNAL_NET is shown below:
ALU(config-firewall-intrusion-snort)# rule modify 1292
content alert tcp $EXTERNAL_NET any -> $EXTERNAL_NET any
(msg:"ATTACK-RESPONSES directory listing";
flow:from_server,established; content:"Volume Serial
Number"; classtype:bad-unknown; sid:1292; rev:8;)
Command (in Intrusion Snort CM) Description
rule enable {{ category
<name>... | classtype <name>... |
priority { high | low | medium }| sid
< 1-4294967295... >}
Use this command to enable Snort rules
by Snort Rule ID (SID), class type,
priority, or category.
rule disable {{ category
<name>... | classtype <name>... |
priority { high | low | medium }| sid
< 1-4294967295... >}
Use this command to disable Snort
rules by Snort rule ID (SID), class type,
priority, or category.
Command (in Intrusion Snort CM) Description
rule modify < 1-4294967295 >
content <rule-content>
Use this command to modify Snort rule.