Displays the status of IPS global settings.
This command is not supported on SmartVision Edition appliances, which are Network Security appliances with SmartVision Edition licenses. The SmartVision Edition sensor is also called Trellix Network Security, SmartVision Edition.
This command displays the appliance-wide status of blocking by IPS rules, the status of the IPS policy manager daemon, and the status of the IPS license.
Note
You can also run this command remotely from the command line of an integrated Trellix Central Management System appliance using the central management appliance proxying mechanism.
Syntax
show ips status
Parameters
None
Output fields
The following table describes the output fields for the command. Fields are listed in the approximate order in which they appear in the output.
Field name | Field description |
|---|---|
IPS enabled | IPS is disabled by default. Use the |
IPS feature active | IPS is active when IPS is enabled. |
IPS feature licensed | The license is embedded in the CLI software. |
Auto‑update rules for an active policy | Status of the auto‑update rules feature for active IPS policies:
This feature is enabled by default. For more information, see the Network Security IPS Feature Guide. |
IPS Global Blocking Status | |
IPS blockmode | Status of the appliance-wide policy to allow, deny, or force blocking of traffic matched by IPS rules:
IPS blockmode is enabled by default. For more information, see the Network Security IPS Feature Guide. |
IPS blockmode last modified | Date and time of the last update to the configuration of appliance-wide disabling or enabling of the blocking actions of all IP rules. |
IPS Configuration Status | |
Fully applied to system | Status of the rules engine with respect to IPS rules specified by the active IPS policies:
|
Config change ID of last change applied | (If the loading of IPS rules is still in progress) System identification number of the IPS configuration change being processed by the rules engine. |
Timestamp of last config change applied | (If the loading of IPS rules is still in progress) Date and time at which the last IPS policy was applied to monitoring interfaces |
Examples
show ips status (No active IPS policies)
hostname # show ips status IPS enabled : yes IPS feature active : yes IPS feature licensed : yes Auto-update rules for an active policy : disabled IPS blockmode : disabled IPS blockmode last modified: 2018/10/20 20:59:14 IPS configuration status : Fully applied to system : N/A (no active policies)
show ips status (Loading of IPS rules into rules engine is complete)
hostname # show ips status IPS enabled : yes IPS feature active : yes IPS feature licensed : yes Auto-update rules for an active policy : disabled IPS blockmode : disabled IPS blockmode last modified: 2018/10/20 20:59:14 IPS configuration status : Fully applied to system : yes
show ips status (Loading of IPS rules into rules engine is in progress
hostname # show ips status IPS enabled : yes IPS feature active : yes IPS feature licensed : yes Auto-update rules for an active policy : disabled IPS blockmode : disabled IPS blockmode last modified: 2018/10/20 20:59:14 IPS configuration status : Fully applied to system : no Config change ID of last change applied : 3026 Timestamp of last config change applied : 2018/10/27 17:55:08
User role
Monitor, Analyst, Operator, or Admin
Command mode
Enable
Supported appliances
This command is supported on the following appliance running the specified release or later:
Network Security: Release 7.2.0. Support for IPS blockmode
allwas introduced in Release 7.5.0. Release 8.0.0. Updated command output to reflect IPS status changes.