Applying an IPS policy to managed platforms (CLI)

From the Central Management System appliance CLI, you can apply an IPS policy to the monitoring interfaces of managed IPS-enabled platforms.

Prerequisites

Verify that the IPS policy to be applied at multiple platforms is identical across those platforms by comparing the fingerprints.

In the following example, the IPS policy p1 is defined identically on the managed appliances in the group NXips.

host (config) # cmc execute group NXips command "show ips policies p1 fingerprint"
============ Appliance NX_900_IPS ============
Execution was successful.
Execution output:
2014/04/18 12:36:34 | 4862cb13e6777d20c3b720d9d5b471a4
============ Appliance NX_10000_IPS ============
Execution was successful.
Execution output:
2014/04/18 13:01:58 | 4862cb13e6777d20c3b720d9d5b471a4

Procedure

To apply an IPS policy on a centrally managed IPS-enabled platform:

Enable CLI configuration mode.

hostname > enable
hostname # configure terminal

Use the cmc execute appliance <targetName> command to execute the ips apply command on an appliance or appliance group:.
- To apply the policy to the management interface of a single managed appliance, use the <targetName> parameter to specify the appliance name.
  The following example applies IPS policy p1 on interface A on appliance named NX4400.
```
host (config) # cmc execute appliance NX4400 command "ips apply p1 interface A"
============ Appliance NX4400 ============
Execution was successful.
Execution output:
(none)
```
- To apply the policy to the management interfaces of multiple appliances, use the <targetName> parameter to specify the appliance group name.
  The following example applies IPS policy p1 on interface A of the appliances in group NXips, which is composed of IPS-enabled appliances NX_900_IPS and NX_10000_IPS.
```
host (config) # cmc execute group NXips command "ips apply p1 interface A"
============ Appliance NX_900_IPS ============
Execution was successful.
Execution output:
(none)
============ Appliance NX_10000_IPS ============
Execution was successful.
Execution output:
(none)
```
Verify your changes by using the cmc execute command to run the "show ips policies <policyName>" command on each affected appliance.
Save your configuration changes on each affected appliance.