Configuring Cisco IOS IPS参考.ppt

Cisco IOS Threat Defense Features Configuring Cisco IOS IPS Cisco IOS IPS Configuration Steps Configure basic IPS settings: Specify SDF location Configure failure parameter Create an IPS rule and, optionally, combine it with a filter Apply the IPS rule to interface Configure enhanced IPS settings: Merge SDFs Disable, delete, and filter selected signatures Reapply the IPS rule to the interface Verify the IPS configuration. Configure Basic IPS Settings Configure Enhanced IPS Settings Verifying IOS IPS Configuration Cisco IOS IPS SDM Tasks Tasks included in the IPS Policies wizard: Quick interface selection for rule deployment Identification of the flow direction Dynamic signature update Quick deployment of default signatures Validation of router resources before signature deployment Signature customization available in the SDM IPS Edit menu: Disable Delete Modify parameters Launching the IPS Policies Wizard IPS Policies Wizard Overview Identifying Interfaces and Flow Direction Selecting SDF Location Selecting SDF Location (Cont.) Selecting SDF Location (Cont.) Viewing the IPS Policies Wizard Summary Verifying IPS Deployment IPS Policies Global Settings Viewing All SDEE Messages Viewing SDEE Status Messages Viewing SDEE Alerts Selecting a Signature Editing a Signature Disabling a Signature Group Verifying the Tuned Signatures Summary You can configure IPS policy on a router by using the CLI or the SDM. CLI does not display the signature parameters. IPS CLI allows you to specify SDF locations, merge SDF files, disable signatures, assign rules to interfaces, and limit the detection scope using ACLs. SDM offers a wizard that simplifies the IPS configuration. IPS Policies wizard deploys default signature definitions from a specified SDF location. You can then use the SDM to edit the policy and modify global settings. SDM offers a view for SDEE messages containing status, errors, and alerts. You can use the SDM to tune the signature parameters. Module Summary Cisco IOS Fir