Configuring Signatures - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 7 Defining Signatures
To configure signature variables, follow these steps:
Log in to the CLI using an account with administrator or operator privileges.
Step 1
Enter signature definition submode:
Step 2
sensor# configure terminal
sensor(config)# service signature-definition sig0
Create a signature variable for a group of IP addresses:
Step 3
sensor(config-sig)# variables IPADD ip-addr-range 10.1.1.1-10.1.1.24
Edit the signature variable for web ports:
Step 4
sensor(config-sig)# variables WEBPORTS web-ports 80,3128,8000
WEBPORTS has a predefined set of ports where web servers are running, but you can edit the value.
This variable affects all signatures that have web ports. The default is 80, 3128, 8000, 8010, 8080, 8888,
24326.
Verify the changes:
Step 5
sensor(config-sig)# show settings
variables (min: 0, max: 256, current: 2)
-----------------------------------------------
80-8080,8888-8888,24326-24326
Exit signature definition submode:
Step 6
sensor(config-sig)# exit
Apply Changes:?[yes]:
Press Enter to apply the changes or type
Step 7

Configuring Signatures

This section describes how to configure signature parameters, and contains the following topics:
•
•
•
•
•
•
•
78-16527-01
variable-name: IPADD
-----------------------------------------------
ip-addr-range: 10.1.1.1-10.1.1.24
-----------------------------------------------
<protected entry>
variable-name: WEBPORTS
-----------------------------------------------
web-ports: 80,3128,8000 default: 80-80,3128-3128,8000-8000,8010-8010,80
-----------------------------------------------
Configuring General Signature Parameters, page 7-4
Configuring Alert Frequency, page 7-5
Configuring Alert Severity, page 7-6
Configuring Event Counter, page 7-8
Configuring Signature Fidelity Rating, page 7-9
Configuring the Status of Signatures, page 7-10
Assigning Actions to Signatures, page 7-11
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
to discard them.
no
Configuring Signatures
7-3