ips signature all

This command was deprecated in Network Security release 9.0.2. Use the following command instead:

policymgr signature all interface {<portPair> | ALL | MGMT} src {<srcIP>/<prefix> | any} dst {<dstIP>/<prefix> | any} action <actionType>

Disables or forces blocking of traffic that matches IPS rules active on the specified interface and comes from a particular destination (victim) IP address and source (attacker) IP address. You can also suppress IPS rules on the specified interface for traffic that comes from a particular destination (victim) IP address and source (attacker) IP address. You can define a total of 1000 entries.

The following restrictions apply to this command:

Disabled or forced blocking is supported for IPS rules with the action option defined as blockable on monitoring interfaces configured for inline blocking mode.
Suppression of reconnaissance activity (ping sweeps or port scans) or brute-force attacks must be configured for all monitoring interfaces. You cannot suppress IPS reconnaissance rules or IPS brute-force rules for individual monitoring interfaces.

Use the show ips signatures CLI command in enable mode to display signature details about blocking or suppression applied to individual IPS rules active on an IPS-enabled appliance.

For information about blocking or suppression, refer to the Network Security IPS Feature Guide.

Note
You can also run this command remotely from the command line of an integrated TrellixCentral Management System appliance using the central management appliance proxying mechanism.

Syntax

[no] ips signature all interface <type> victim [<IP_address>/<subnet_mask> | any] attacker [<IP_address>/<subnet_mask> | any] action <action>

Parameters

<term>

no

</term>Use the no form of this command to undo this operation—to restore the blocking action or to disable suppression for an IPS rule from a particular IP address.<term>

all

</term>Specifies that the blocking action or disabled suppression action applies to all signatures.<term>

interface <type>

</term>Specify the appliance monitoring interface based on your product model. Type can be A, B or ALL.<term>

victim <IP_address>

</term>Specify an individual victim IP address (destination).<term>

attacker <IP_address>

</term>Specify an individual attacker IP address (source).<term>

any

</term>Specify all victim IP addresses (destination) and all attacker IP addresses (source) on which to override the specified blocking action for an IPS rule, or to suppress an IPS rule.<term>

action <action>

</term>Specify the action to override the specified blocking action for an IPS rule, or to suppress an IPS rule. To disable or force blocking for the rule on the specified interface, specify one of the following values. These values apply only to rules with the action option set to blockable and are valid only for interfaces configured for inline blocking.

block—Force blocking of traffic that matches the rule on the specified interface and particular destination (victim) IP address and source (attacker) IP address.

unblock—Disable blocking of traffic that matches the rule on the interface and particular destination (victim) IP address and source (attacker) IP address.

To suppress the rule for traffic matched on the specified interface, specify one of the following values:

suppress—Suppress the IPS rule on the specified interface and particular destination (victim) IP address and source (attacker) IP address so that matched traffic does not trigger IPS events or generate IPS notifications. Matched traffic is handled according to the blocking action specified in the rule definition.

suppress-unblock—On interfaces configured for inline blocking, suppress the IPS rule on a particular destination (victim) IP address and source (attacker) IP address.

The following caveats apply to the suppression of an IPS rule:

Suppression of reconnaissance activity (ping sweeps or port scans) or brute-force attacks must be configured for all monitoring interfaces. It cannot be configured for individual interfaces. The CLI configuration ips blockmode disabled disables blocking for all IPS rules and takes precedence over rule overrides specified for an IPS rule. On such a system, traffic that matches an IPS rule that is suppressed or suppressed and disabled is not suppressed and is not blocked. The CLI configuration ips blockmode all forces blocking for all IPS rules and takes precedence over rule overrides specified for an IPS rule. On such a system, traffic that matches an IPS rule that is suppressed or suppressed and disabled is not suppressed and is blocked.

Defaults

If you do not specify this command, traffic that matches the IPS rule is blocked as specified in the rule definition, triggers IPS events, and generates IPS notifications as configured for the event type.

If you use the command without specifying an action mode and interface name:
The system configures a default exception policy for the specified IPS rule. On interfaces configured for inline blocking, traffic that matches the IPS rule is blocked if the action option in the rule definition is set to blockable.
If you use the no form of the command without specifying an action mode and interface name:
The system restores the blocking action or disables suppression for the specified rule on all interfaces. Unlike using the command and specifying a specific override and ALL interfaces, this command removes the corresponding signature from the table in the show ips signatures CLI command output and from the table in the Web UI IPS > IPS Policy Exceptions page.

Examples

The following example suppresses a rule for all signatures on all interfaces from a particular IP address:

hostname (config) # ips signature all interface ALL victim 107.182.166.198/32 attacker 183.244.186.168/32 action suppress

The following example disables blocking for a rule for all signatures on all interfaces from a particular IP address:

hostname (config) # ips signature all interface ALL victim 128.120.188.217/32 attacker 8.39.37.21/32 action unblock

User role

Operator or Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Network Security: Release 8.1.2. This command was deprecated in release 9.0.2.