Includes or excludes a specific IPS rule in a custom IPS policy.
You can modify the specified IPS policy by specifically including or excluding the specified IPS rule. The policy must be inactive. For more information about IPS policies, see the Network Security IPS Feature Guide.
Note
You can also run this command remotely from the command line of an integrated Central Management System appliance using the central management appliance proxying mechanism.
Syntax
[no] ips policy<policyName>rules (exclude | include) <sigID>
Parameters
no
Use the no form of the command to remove the specified rule-exclusion or rule-inclusion attribute from the specified IPS policy. The policy must be inactive.
<policyName>
Name of the custom IPS policy to modify. The policy must be inactive.
include <sigID>
Signature ID of the IPS rule to include, provided the rule is in the appliance database.
exclude <sigID>
Signature ID of the IPS rule to exclude, even if the rule is in the appliance database and a match attribute in the policy would otherwise select the rule. This attribute overrides attributes specified by the ips policy match command.
Examples
ips policy myCustom1 rules exclude
hostname (config) # ips policy myCustom1 rules exclude 85300508
no ips policy myCustom1 rules include
hostname (config) # no ips policy myCustom1 rules include 85301781 hostname (config) # no ips policy myCustom1 rules include 85301782
User role
Operator or Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 7.2.0