Cisco IPS 7.1 Installation Guide download pdf (Page 27)

1-11

Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1

OL-24002-01

Chapter 1 Introducing the Sensor

How the Sensor Functions

TCP Reset Interfaces

This section explains the TCP reset interfaces and when to use them. It contains the following topics:

• Understanding Alternate TCP Reset Interfaces, page 1-11

• Designating the Alternate TCP Reset Interface, page 1-12

Understanding Alternate TCP Reset Interfaces

Note The alternate TCP reset interface setting is ignored in inline interface or inline VLAN pair mode,

because resets are sent inline in these modes.

You can configure sensors to send TCP reset packets to try to reset a network connection between an

attacker host and its intended target host. In some installations when the interface is operating in

promiscuous mode, the sensor may not be able to send the TCP reset packets over the same sensing

interface on which the attack was detected. In such cases, you can associate the sensing interface with

an alternate TCP reset interface and any TCP resets that would otherwise be sent on the sensing interface

when it is operating in promiscuous mode are instead sent out on the associated alternate TCP reset

interface.

If a sensing interface is associated with an alternate TCP reset interface, that association applies when

the sensor is configured for promiscuous mode but is ignored when the sensing interface is configured

for inline mode. any sensing interface can serve as the alternate TCP reset interface for another sensing

interface.

Note There is only one sensing interface on the ASA IPS modules (ASA 5500 AIP SSM,

ASA 5500-X IPS SSP, and ASA 5585-X IPS SSP), so you cannot designate an alternate TCP reset

interface.

Table 1-3 lists the alternate TCP reset interfaces.

Table 1-3 Alternate TCP Reset Interfaces

Sensor Alternate TCP Reset Interface

ASA 5500 AIP SSM-10 None

ASA 5500 AIP SSM-20 None

ASA 5500 AIP SSM-40 None

ASA 5512-X IPS SSP None

ASA 5515-X IPS SSP None

ASA 5525-X IPS SSP None

ASA 5545-X IPS SSP None

ASA 5555-X IPS SSP None

ASA 5585-X IPS SSP-10 None

ASA 5585-X IPS SSP-20 None

ASA 5585-X IPS SSP-40 None

ASA 5585-X IPS SSP-60 None

1 ... 26 27 28 ... 422

No comments

Cisco IPS 7.1 Installation Guide Page 27