ips signature name ＜name＞

This command was deprecated in Network Security release 9.0.2. Use the following command instead:

policymgr signature name <sigName> interface {<portPair> | ALL | MGMT} src {<srcIP>/<prefix> | any} dst {<dstIP>/<prefix> | any} action <actionType>

Disables or forces blocking of matched traffic that matches a vulnerability active on the specified interface and comes from a particular destination (victim) IP address and source (attacker) IP address. You can also suppress a vulnerability on the specified interface for traffic that comes from a particular destination (victim) IP address and source (attacker) IP address. You can define a total of 1000 entries.

The following restrictions apply to this command:

Disabled or forced blocking is supported for IPS rules with the action option defined as blockable on monitoring interfaces configured for inline blocking mode.
Suppression of reconnaissance activity (ping sweeps or port scans) or brute-force attacks must be configured for all monitoring interfaces. You cannot suppress IPS reconnaissance rules or IPS brute-force rules for individual monitoring interfaces.

Use the show ips signatures CLI command in enable mode to display signature details about blocking or suppression applied to vulnerabilities active on an IPS-enabled appliance.

For information about blocking or suppression, refer to the Network Security IPS Feature Guide.

Note
You can also run this command remotely from the command line of an integrated Trellix Central Management System appliance using the central management appliance proxying mechanism.

Syntax

[no] ips signature name <name> interface <type> victim [<IP_address>/<subnet_mask> | any] attacker [<IP_address>/<subnet_mask> | any] action <action>

Parameters

<term>

no

</term>

Use the no form of this command to undo this operation—to restore the blocking action or to disable suppression for an IPS rule from a particular IP address.

<term>

name

</term>An IPS vulnerability name.<term>

interface <type>

</term>Specify the NX appliance monitoring interface based on your product model.<term>

victim <IP_address>/<subnet_mask>

</term>Specify an individual victim IP address (destination) and the subnet mask.<term>

attacker <IP_address>/<subnet_mask>

</term>Specify an individual attacker IP address (source) and the subnet mask.<term><term>

any

</term>Specify all victim IP addresses (destination) and all attacker IP addresses (source) on which to override the specified blocking action for a vulnerability, or to suppress a vulnerability.

action <action>

</term>Specify the action to override the specified blocking action for a vulnerability, or to suppress a vulnerability. To disable or force blocking for the vulnerability on the specified interface, specify one of the following values. These values apply only to rules with the action option set to blockable and are valid only for interfaces configured for inline blocking.

block—Force blocking of traffic that matches the vulnerability on the specified interface and particular destination (victim) IP address and source (attacker) IP address.

unblock—Disable blocking of traffic that matches the vulnerability on the interface and particular destination (victim) IP address and source (attacker) IP address.

suppress—Suppress the vulnerability on the specified interface and particular destination (victim) IP address and source (attacker) IP address so that matched traffic does not trigger IPS events or generate IPS notifications. Matched traffic is handled according to the blocking action specified in the rule definition.

suppress-unblock—On interfaces configured for inline blocking, suppress the vulnerability on a particular destination (victim) IP address and source (attacker) IP address.

The following caveats apply to the suppression of a vulnerability:

Suppression of reconnaissance activity (ping sweeps or port scans) or brute-force attacks must be configured for all monitoring interfaces. It cannot be configured for individual interfaces. The CLI configuration ips blockmode disabled disables blocking for all IPS rules and takes precedence over rule overrides specified for a vulnerability. On such a system, traffic that matches an IPS rule that is suppressed or suppressed and disabled is not suppressed and is not blocked. The CLI configuration ips blockmode all forces blocking for all IPS rules and takes precedence over rule overrides specified for a vulnerability. On such a system, traffic that matches an IPS rule that is suppressed or suppressed and disabled is not suppressed and is blocked.

Defaults

If you do not specify this command, traffic that matches the vulnerability is blocked as specified in the rule definition, triggers IPS events, and generates IPS notifications as configured for the event type.

If you use the command without specifying an action mode and interface name:
The system configures a default exception policy for the specified vulnerability. On interfaces configured for inline blocking, traffic that matches the vulnerability is blocked if the action option in the rule definition is set to blockable.
If you use the no form of the command without specifying an action mode and interface name:
The system restores the blocking action or disables suppression for the specified vulnerability on all interfaces. Unlike using the command and specifying a specific override and ALL interfaces, this command removes the corresponding signature from the table in the show ips signatures CLI command output and from the table in the Web UI IPS > IPS Policy Exceptions page.

Examples

The following example suppresses a vulnerability on all interfaces from a particular IP address:

hostname (config) # ips signature name Exploit Kit Landing Page interface ALL victim 107.182.166.198/32 attacker 183.244.186.168/32 action suppress

The following example disables blocking for a vulnerability on all interfaces from a particular IP address:

hostname (config) # ips signature name Trojan.Rammit interface ALL victim 128.120.188.217/32 attacker 8.39.37.21/32 action unblock

User role

Operator or Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Network Security: Release 7.7. This command was deprecated in release 9.0.2.