Configuring The Sensor To Manage Cisco Routers; Routers And Acls; Routers - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 10 Configuring Blocking
Network Access Controller uses two ACLs to manage devices. Only one is active at any one time. It uses
the offline ACL name to build the new ACL, then applies it to the interface. Network Access Controller
then reverses the process on the next cycle.
Note The ACLs that NAC creates are not removed from the managed device after you configure NAC to no
longer manage that device. You must remove the ACLs manually on any device that NAC formerly
managed.
If you need to modify the Pre-Block or Post-Block ACL, do the following:
1.
2.
3.
When blocking is reenabled, the sensor reads the new device configuration. For the procedure, see
Disabling Blocking, page
A single sensor can manage multiple devices, but you cannot use multiple sensors to control a single
Caution
device. In this case, use a master blocking sensor. For the procedure, see
Master Blocking Sensor, page

Configuring the Sensor to Manage Cisco Routers

This section describes how to configure the sensor to manage Cisco routers. It contains the following
topics:
•
•

Routers and ACLs

You create and save Pre-Block and Post-Block ACLs in your router configuration. These ACLs must be
extended IP ACLs, either named or numbered. See your router documentation for more information on
creating ACLs.
Enter the names of these ACLs that are already configured on your router in the Pre-Block ACL and
Post-Block ACL fields.
The Pre-Block ACL is mainly used for permitting what you do not want the sensor to ever block. When
a packet is checked against the ACL, the first line that gets matched determines the action. If the first
line matched is a permit line from the Pre-Block ACL, the packet is permitted even though there may be
a deny line (from an automatic block) listed later in the ACL. The Pre-Block ACL can override the deny
lines resulting from the blocks.
78-16527-01
Make sure the last line in the ACL is permit ip any any if you want all unmatched
Note
packets to be permitted.
– permit ip any any (not used if a Post-Block ACL is specified)
Disable blocking on the sensor.
Make the changes to the device's configuration.
Reenable blocking on the sensor.
10-6.
Routers and ACLs, page 10-19
Configuring the Sensor to Manage Cisco Routers, page 10-20
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
10-25.
Configuring Blocking Devices
Configuring the Sensor to be a
10-19