Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 188

Configuring Blocking Properties
You can specify a single host or an entire network.
To set up addresses never to be blocked by blocking devices, follow these steps:
Log in to the CLI using an account with administrator privileges.
Step 1
Enter network access submode:
Step 2
sensor# configure terminal
sensor(config)# service network-access
Enter general submode:
Step 3
sensor(config-net)# general
Define the address that should never be blocked:
Step 4
For a single host:
•
sensor(config-net-gen)# never-block-hosts 10.16.0.0
For an entire network:
•
sensor(config-net-gen)# never-block-networks 10.0.0.0/8
Verify the settings:
Step 5
sensor(config-net-gen)# show settings
general
-----------------------------------------------
--MORE--
Exit network access submode:
Step 6
sensor(config-net-gen)# exit
sensor(config-net)# exit
Apply Changes:?[yes]:
Step 7 Press Enter to apply the changes or type
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
10-16
log-all-block-events-and-errors: true <defaulted>
enable-nvram-write: false <defaulted>
enable-acl-logging: false <defaulted>
allow-sensor-block: false default: false
block-enable: true default: true
block-max-entries: 100 default: 250
max-interfaces: 250 <defaulted>
master-blocking-sensors (min: 0, max: 100, current: 0)
-----------------------------------------------
-----------------------------------------------
never-block-hosts (min: 0, max: 250, current: 2)
-----------------------------------------------
ip-address: 10.16.0.0
-----------------------------------------------
ip-address: 11.11.11.11
-----------------------------------------------
-----------------------------------------------
never-block-networks (min: 0, max: 250, current: 2)
-----------------------------------------------
ip-address: 10.0.0.0/8
-----------------------------------------------
ip-address: 12.12.0.0/16
to discard them.
no
Chapter 10 Configuring Blocking
78-16527-01