Using ACLs When Disabling Individual Signatures

You can use the ip audit signature command to apply ACLs to individual signatures to help filter out sources of false alarms. When attaching an ACL to a signature, then it’s also necessary to create an audit rule with the ip audit name command and to apply that named rule to an interface with the ip audit command.

In this example, the 1001 signature is disabled and signature 1004 has ACL 10 attached. As in the preceding example, the ACL doesn’t behave as you might initially assume. The hosts on the defined network aren’t filtered through the signature because they’re trusted hosts or, possibly, because they’re causing false positives to occur. All other hosts are defined by the permit any statement and are to be processed by the audit rule.

Rtr1(config)#ip audit signature 1001 disable
Rtr1(config)#ip audit signature 1004 list 10
Rtr1(config)#access-list 10 deny 192.168.45.0 0.0.0.255
Rtr1(config)#access-list 10 permit any