Make sure the IPS policies that you want to assign to Sensor resources are available.
In Trellix IPS, IPS policies are enforced at the interfaces and subinterfaces, not at the Sensor level. Since the Sensors are multi-port devices with multiple interfaces and subinterfaces, this allows multiple policies to be enforced within a single Sensor rather than a single catch-all policy. Compared to some other IPS products, this is like having several Sensors in one box.
When you create an admin domain, you can select the Default Prevention and Default Reconnaissance Policy for that admin domain. When you add a Sensor to that domain or allocate interfaces and subinterfaces, these policies are applied to those Sensor resources by default. You can assign different policies to those Sensor interfaces and subinterfaces through the corresponding Policy Manager page. An alternative method is to assign an IPS policy from the IPS page itself. This is especially useful when you want to define an IPS policy and also quickly assign it to Sensor interfaces and subinterfaces.
Note
Interfaces assigned to a policy group can only be managed from the Policy Manager page and not from the IPS page.
Steps:
Click the Policy tab.
From the Domain drop-down list, select the domain you want to work in.
Select Intrusion Prevention → Policy Types → IPS.
Click the Assignments value of the policy that you want to assign.
The Assignments window is displayed.
Assign the IPS policy to the required interfaces and subinterfaces.
Assignments window.png "GUID-7A751574-1951-47CE-ADAA-31F09A7309E2-low.png")
Option
Definition
Search Interfaces
To filter the list of available interfaces, enter a string that is part of the Available Interfaces.
Available Interfaces
Lists the interfaces and subinterfaces of the Sensors in the admin domain. The Sensor interfaces to which you have already assigned this IPS policy are displayed under Selected interfaces.
Note
In case of Sensors in failover, the ports used for interconnection of the Sensors are not displayed. If you assign an IPS policy to an interconnect port, the assignment is automatically removed when you create the HA pair.
Select a resource and click
.png)
to move it to Selected Interface.Current Policy
The IPS policy that is currently assigned to an interface. To replace that policy with the policy that you are currently assigning, move the interface to Selected Interface.
Selected Interface (Policy Group)
Lists the Sensor interfaces to which you have assigned the selected IPS policy
Reset
Reverts to last saved configuration
Save
Saves the changes to the Manager database
Cancel
Closes the Assignments window without saving the changes
If you move a Sensor resource from Selected Interface to Available Interfaces, the Sensor's IPS policy is automatically applied to those Sensor resources.
.png)
Consider a scenario illustrated by the diagram. The admin domain AD is assigned the IPS policy - P1. It has Sensor 1 under it and a child admin domain named CAD.
CAD is assigned the IPS policy P1. Sensor 1 is assigned the IPS policy P2. The interface G0/1-G0/2 is assigned the IPS policy P3.
The subinterfaces VLAN10 is assigned the IPS policy P4.
The interface G1/1-G1/2 of Sensor 1 is allocated to CAD. This is assigned IPS policy, P5.
VLAN20 is a subinterfaces of G1/1-G1/2 and is assigned a policy P6.
In the Assignments window of P3, if you move G0/1-G0/2 from Selected Interface to Available Interfaces, P2 is applied to this interface. Similarly, if you move VLAN10 for P4, then P2 is applied to this subinterfaces, which means these resources fall back to the Sensor's policy.
Similarly, if you move G1/1-G1/2 and VLAN20 from Selected Interface to Available Interfaces in the corresponding policies, the IPS policy P1 is applied. That is, these interfaces fall back to the IPS policy of the domain to which they are allocated.
If any resource has a local IPS policy customization and you remove this interface from Selected Interface to Available Interfaces in the corresponding policy, the same local policy customization is made to the policy to which it falls back. However, for this, the same attacks must be present in this fallback IPS policy as well.
Do a configuration update for the corresponding Sensors to enforce the policy.