-----Original Message-----
From: Dan Tesch [mailto:dan.tesch@comcast.net]
Sent: Monday, September 27, 2004 9:12 PM
To: firewalls@securityfocus.com
Subject: Re: IOS IDS configuration
Thanks, I do understand how to actually delete a line
I was wondering if there is any benefit to doing so.
For instance, I was trying to do some admin. from home
but could not get my config to copy to a TFTP server
at home via internet - didn't know if the ip inspect tftp
line had something to do with it - and why some of
these on eth_0 and some eth_1??
The config you have pasted into the email doesn't tell us what the IDS will
do when an alarm fires. Simply inspecting tftp traffic doesn't interfere
with your connection,unless you have an action defined to drop it on a
signature match. There should be a line like
ip audit name Ethernet_0_1 action { alarm | drop | reset }
that tells the router what to do when a tftp signature is matched. There
should also be a config line that binds the policy to the particular
interface. You'll see it under that interface's configuration like this
ip audit Ethernet_0_1 in
...just for example.
I would suggest maybe turning on some packet debugging and or watching
matches to an ACL to troubleshoot your problem.
Type the line you wish to delete with a 'no' infront of it,
should do
it. (eg 'no ip inspect name Ethernet_0_1 ftp')
Dan Tesch wrote:
Hi, we have the IOSIDS functions enabled in our 2611
and I have read the docs but don't know if I can
disable single lines in the config.
example:
ip inspect max-incomplete high 1100
ip inspect one-minute high 1100
ip inspect name Ethernet_0_1 smtp
ip inspect name Ethernet_0_1 ftp
ip inspect name Ethernet_0_1 tcp
ip inspect name Ethernet_0_1 udp
ip inspect name Ethernet_0_1 cuseeme
ip inspect name Ethernet_0_0 tcp
ip inspect name Ethernet_0_0 udp
ip inspect name Ethernet_0_0 cuseeme
ip inspect name Ethernet_0_0 ftp
ip inspect name Ethernet_0_0 h323
ip inspect name Ethernet_0_0 rcmd
ip inspect name Ethernet_0_0 realaudio
ip inspect name Ethernet_0_0 smtp
ip inspect name Ethernet_0_0 streamworks
ip inspect name Ethernet_0_0 vdolive
ip inspect name Ethernet_0_0 sqlnet
ip inspect name Ethernet_0_0 tftp
ip audit notify log
ip audit po max-events 100
these appear to be defaults, if I am not using something
like vdolive,
sqlnet, streamworks, realaudio, etc. can I delete the
lines? are there
some helpful extra parameters anyone can suggest?
Thanks
Shane Mahon, CCNP, CCSP, RHCE
Internet Operations Manager
Newsstand, Inc.
http://www.newsstand.com
