Alert Filter Assignments - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
Managing policy across the IPS Sensor
The
interfaces in cases where the original policy needs to be deleted. For example, you have
created a custom policy called
single Sensor. After some time, you determine
want to delete it. Manager will not allow you to delete a policy that is currently enforced
(through interface application). You have to change the policy of each VIPS (For more
information, see VIPS—Applying policies at the interface and sub-interface level (on page
213)) where the custom policy is applied before deleting the custom policy itself.
To apply an alternate policy to a Sensor, do the following:
1
Figure 169: IPS Sensor: Applying Policy
2
3
4
5

Alert filter assignments

To apply alert filters to resources from the Configuration page, select one of the following
nodes from the Resource Tree:
•
•
•
Policy
tab enables you to set an alternate policy for a Sensor's interfaces/sub-
IPS Settings/ <Sensor_Name> > IPS Sensor > Policy
Select
<Sensor_Name> > IPS Failover Pair > Policy
IPS Policy
Toggle the drop-down list to select a new IPS policy.
Reconnaissance Policy
Toggle the
Apply
Click .
A pop-up displays that policy change requires a download to the Sensor.
OK
Click , in the pop-up, and you are re-directed to the
more information, see Updating the configuration of a Sensor.
IPS Settings > Alert Filters > Filter Assignments
IPS Settings:
IPS Settings / Sensor_Name/ IPS Sensor > Alert Filters
Sensor:
IPS Settings <sensor name><port name> > Scanning > Alert Filters
Interface/Sub-interface:
Custom1
. You apply it to interfaces 1B, 2A, and 4B on a
Custom1
does not work effectively, and you
IPS Settings/ Failover Pair Node/
(
in the case of failover pair Sensors).
drop-down list to select a Reconnaissance Policy.
157
The IPS Sensor_Name node
Configuration Update
page. For