User's Manual

Security Services
Intrusion Prevention Service
Cisco ISA500 Series Integrated Security Appliance Administrator Guide 217
7
• IPS (Signature) Enable: If you enable IPS, click On to enable the IPS Policy
and Protocol Inspection settings.
• View IPS Category Items: Allows you to view the signatures under a
specific IPS category or protocol. For example, if you choose DoS, only the
signatures under the DoS category are displayed. To display all signatures,
choose All.
• Search by IPS Signature ID: Allows you to view a specific signature by
searching the signature ID. Enter the signature ID in this field, and then click
Search. To display all categories and protocols, click Reset.
• Expand/Collapse: To expand the signatures under a category, click the +
button next to the category heading. To hide the signatures, click the - button.
NOTE To get the definition of the signatures, go to http://tools.cisco.com/
security/center/search.x?search=Signature to check the Small
Business IPS signature definitions by using the Signature ID or other
information.
STEP 3 Specify the inspection setting for all signatures under a category or for a signature
only.
• Disabled: Click this option to disable checking the attacks.
• Detect Only: Click this option to check the attacks and to log the event when
an attack is detected. This option is mostly used for troubleshooting
purposes.
• Detect and Prevent: Click this option to check the attacks and to log the
event and drop the packet when an attack is detected.
To log the IPS events, you first need to choose Detect Only or Detect and
Prevent for the IPS categories or IPS signatures, and then go to the Device
Management -> Loggings pages to configure the log settings and log
facilities:
- To save the IPS logs in the lcoal syslog daemon, you need to enable the
Log feature, set the log buffer size and the severity for local log, and then
check the Local Log box for the IPS (signature based) and IPS
(reputation based) log facilities.