Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
217
7
•
IPS (Signature) Enable:
If you enable IPS, click
On
to enable the IPS Policy
and Protocol Inspection settings.
•
View IPS Category Items:
Allows you to view the signatures under a
specific IPS category or protocol. For example, if you choose DoS, only the
signatures under the DoS category are displayed. To display all signatures,
choose
All
.
•
Search by IPS Signature ID:
Allows you to view a specific signature by
searching the signature ID. Enter the signature ID in this field, and then click
Search
. To display all categories and protocols, click
Reset
.
•
Expand/Collapse:
To expand the signatures under a category, click the
+
button next to the category heading. To hide the signatures, click the
-
button.
NOTE
To get the definition of the signatures, go to
security/center/search.x?search=Signature
to check the Small
Business IPS signature definitions by using the Signature ID or other
information.
STEP 3
Specify the inspection setting for all signatures under a category or for a signature
only.
•
Disabled:
Click this option to disable checking the attacks.
•
Detect Only:
Click this option to check the attacks and to log the event when
an attack is detected. This option is mostly used for troubleshooting
purposes.
•
Detect and Prevent:
Click this option to check the attacks and to log the
event and drop the packet when an attack is detected.
To log the IPS events, you first need to choose
Detect Only
or
Detect and
Prevent
for the IPS categories or IPS signatures, and then go to the
Device
Management -> Loggings
pages to configure the log settings and log
facilities:
-
To save the IPS logs in the lcoal syslog daemon, you need to enable the
Log feature, set the log buffer size and the severity for local log, and then
check the Local Log box for the
IPS (signature based)
and
IPS
(reputation based)
log facilities.
