ccna 5 pdf

ccna 5 pdf.Alerts are triggered when specific parameters are matched. The administrator must balance the number of false alerts that can be tolerated with the ability of the features used to detect the actual intrusion. If the number of alerts is small, suspicious packets will be allowed into the network, but network traffic will flow quickly. However, if the IPS system uses untuned features, it can generate many false alarms.To implement feature alerts in Cisco Configuration Expert, you need to select Configure > Security > Intrusion Prevention in the navigation panel oFeatures can be adjusted to one of four levels based on the severity of the perceived feature....High (high) - Can detect attacks used to gain access or attacks that cause DoS, and most likely direct threats.Medium - detects anomalous network behavior that can be considered malicious and is likely to be a direct threat. (low)--Anomalies detected can be considered malicious network behavior, but are not likely to be a direct threat. Reported (informational) - Behavior that triggers a feature is not considered a direct threat, but will provide useful information.There are many factors to consider when implementing alarms for feature use. The level assigned to the feature determines the severity level of the alarm.5.2 IPS Features 131 When adjusting feature alarms, the severity level of the feature must be the same as the severity level of the alarm. To try to avoid false alarms, administrators must study existing network traffic patterns and then adjust features to recognize atypical (unlike) intrusion patterns. Feature tuning must rely on real network traffic patterns to be performed.5.2.4 IPS Feature Behavior