Applying the Audit Name

Use the interface configuration mode command ip audit to apply an audit specification created with the ip audit name command to a specific interface and for a specific direction. Use the no version of this command to disable auditing of the interface for the specified direction. The syntax is

Rtr1(config-if)#ip audit audit-name {in | out}
Rtr1(config-if)#no ip audit audit-name {in | out}

This command was introduced in IOS 12.0(5)T. The default that no audit specifications are applied to an interface or direction is implied.

In the following example, the default action for attack signatures is set to all three actions, and the audit specification—Attack.7—is applied inbound on the Ethernet interface:

Rtr1(confisg)#interface e0
Rtr1(config-if)#ip audit Attack.7 in