MSN
join:2004-05-15
Osgoode, ON
| reply to mr_dirt
Re: [Config] 871 & 12.4(15)T3 DebugsON ?
I'm running the complete "basic" list per the SDM's recommendations. Since the 871 only has 128 MB RAM, the advanced list will cause memory faults when traffic is high.
That said, I've only disabled two signatures. Cisco recently announced a TTL vulnerability in their IOS and two of the signatures matched against this type of DoS attack. I was getting too many false positives (mainly from UPnP and dynamic routing protocol...basically IP multicast) so I turned 'em off.
As I said in my 1st post, what impresses me most is that througput doesn't seem to be affected in the least with the IPS engines (13 of them) all turned on.
/Eric |
|
mr_dirt
join:2006-02-14
Denver, CO | Thanks for the details. |
|
MSN
join:2004-05-15
Osgoode, ON | You're welcome.
Also, I'm running 384 signatures.
/Eric |
|
