Exclude destination address from sig

New to Cisco IPS....
I wish to EXCLUDE a single destination IP address from a signature -- have the sig fire it it trips for all BUT one IP address (which is a confirmed false positive).
The sig name is BO2K-UDP. want to have it ignore events for a single destination but have it trip normally for all other destinations. Thanks.

You want to set up an Event Action Filter.
Here's the 6.0 version:
http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliEvAct.html

Similar Messages

Robocopy - exclude destination files from /MIR

Attempting to do a nightly run of robocopy while we transfer over to a new file server. We've a load of extra files with an offline attribute on the destination, which are files archived by Enterprise Vault which we moved in advance, and so these must not
be touched.
If I do robocopy source destination /MIR /XA:O, all these files still get deleted. Shouldn't the exclude switch apply to files on the destination as well as the source?

Thanks for the Replies.
Aaron, that doesn't seem to be the case, /MIR /XA:O doesn't exclude offline files that are on the destination only
Shaon, there are no files on the source that have the offline attribute, they've been moved over to the destination server already using a different (very slow) process, and now I want to keep the normal files in sync, including copying over new files
and deleting any files that no longer exist on the source, without deleting the files with an offline attribute. /xn would allow me to copy the newly changed files over, but I can't think of a way of deleting files on the destination.
I may have to go with just /xn, which isn't perfect

SBS2011/ Exchange 2010 removing destination address from inbound email

I've added a 2nd 'accepted domain' into my server, AD users have been automatically populated with the 2nd email address, users can choose who to reply as etc. email addressed to
[email protected] and
[email protected] arrives in Fred's email account BUT I cant see if the inbound message has come to @company1.com or @company2.com. If I examine the headers of the message the info is there, so Exchange knows, but the user can't see who the msg was addressed
to, the To: field just shows the Exchange 'display name'. Hope that make sense. I'm hoping there's a policy or tick box I've missed, any help please.

Perhaps we are dealing with the wrong end of the stick. <g>. What if the various sources that prompt the incoming had slightly different first name.
Info1@company1,
info2@company2 and so on. Would take a bit of work to change all your websites and literature, but it would resolve this over time.
Baring that, and depending on the level of curiosity of your staff there are ways to read the message headers. If there is a large volume of such messages it
would be boring work, but for a few each week perhaps something like this:
http://exchangeserverpro.com/how-to-read-email-message-headers/
And there maybe apps that will show them in place, I did not search for that.
Larry Struckmeyer[MVP] If your question is answered please mark the response as the answer so that others can benefit.

How do I copy multiple email addresses from one email sent TO me into a new message?

How do I copy multiple email addresses from an email sent to me into a new message?

Are they in the body of the mail?
Hold your finger down in that mail until the little blue bubble pops up. One of the options should be to select all. Choose that and all will be hilighted. then a pop up comes up to copy, choose that, open your destination and hold your finger down to get the paste dialogue.

Syslog Destination Address

Hi there,
since my ABSE is constantly rebooting I'm trying to get some logs. I can't use the Airport Utility for that purpose since it's not streaming the logs. Also, as soon as the ABSE reboots it dumps the logs.
So I'm trying to stream the logs to my MacBook using the Advanced/Logging & SNMP/Syslog Destination Address.
In that field I've entered the IP address of my MacBook. I've connected it using Ethernet, disabled Airport. Syslog Level to "Debug" -> Update
Then I open my Console and nothing, I've looked in the different Logs everywhere and can't find anything.
Has anyone got it working?
Micha

Hi,
I have not got it working, I would also like to do the same thing, but I believe it is quite tricky. By default I believe that OS X 10.4 is NOT configured to be able to receive syslog log messages over the network.
The program that actually listens for log messages, from the network or from local apps, is called syslogd. www.macosxhintss.com hints has a somewhat confusing write-up on how to reconfigure it to receive messages from the network (http://www.macosxhints.com/article.php?story=20060327074531639). However, this involves tampering with files off of the /System/Library subdirectory, so I'd rather not risk it.
MacBook Pro Mac OS X (10.4.9)
MacBook Pro Mac OS X (10.4.9)

APs unable to receive IP address from DHCP (core 6500 series switch)

Dear Friends,
a week ago I had stable wireless network APs were getting IPS from 6500 series switch (DHCP) but unfortunately some WISM got rebooted and now APs are unable to receive IP address from Core 6500 DHCP, to cater this issue I have another DHCP server configured on windows 2008 i created another subnet and and put APs in that vlan now all APs are are successfully receiving IPS from windows DHCP server I don't know why APs are not able to receive IPs from core 6500 series DHCP.
please advice
Thanks
Faysal

Thanks george for stepping up here is DHCP config
ip dhcp excluded-address 10.10.30.1 10.10.30.20
ip dhcp excluded-address 10.10.8.1 10.10.8.10
ip dhcp excluded-address 192.168.10.1 192.168.10.5
ip dhcp excluded-address 10.9.20.1 10.9.20.30
ip dhcp pool vlan_30
network 10.10.30.0 255.255.254.0
default-router 10.10.30.1
option 60 ascii """"""""""""""""""""""""CiscoAPc1250""""""""""""""""""""""""
option 43 hex f110.0a0a.1e0b.0a0a.1e0d.0a0a.1e0f.0a0a.1e11
dns-server 10.10.2.11
lease infinite
ip dhcp pool WiSM1_SP
network 192.168.10.0 255.255.255.248
default-router 192.168.10.1

Clients not receiving addresses from DHCP

I have a Cisco 2811 router and have configured it to be a DHCP server at a remote site. It seems like it should be pretty straight forward to configure DHCP. Apparently I'm missing something because I can't get clients to receive an address. Below are the applicable parts of the config. I also have tried associating the DHCP pool with the Claims vrf and that did not work either.
ip dhcp excluded-address 10.10.30.0 10.10.30.99
ip dhcp excluded-address 10.10.30.201 10.10.30.255
ip dhcp pool Claims_Office
   network 10.10.30.0 255.255.255.0
   domain-name fmi.com
   default-router 10.10.30.253
   dns-server 10.10.10.191
   lease 7
interface FastEthernet0/0
description Claims Office
vrf forwarding Claims
ip address 10.10.30.253 255.255.255.0
duplex auto
speed auto
no mop enabled
interface FastEthernet0/0/0.1205
description Claims Office
vrf forwarding Claims
encapsulation dot1Q 1205
ip address 192.168.103.2 255.255.255.252

Unfortunately that didn't work. Here is the output before:
Pool Claims_Office :
Utilization mark (high/low)    : 100 / 0
Subnet size (first/next)       : 0 / 0
Total addresses                : 254
Leased addresses               : 0
Pending event                  : none
1 subnet is currently in the pool :
Current index        IP address range                    Leased addresses
10.10.30.1           10.10.30.1       - 10.10.30.254      0
And after:
Pool Claims_Office :
Utilization mark (high/low)    : 100 / 0
Subnet size (first/next)       : 0 / 0
Total addresses                : 254
Leased addresses               : 0
Pending event                  : none
1 subnet is currently in the pool :
Current index        IP address range                    Leased addresses
10.10.30.1           10.10.30.1       - 10.10.30.254      0
What I want is for it to assign addresses from 10.10.30.100-199

Error "Extend the destination address using the location input help"

Hi experts,
I got warning while creating travel expense from existing travel request.
the warning appear like this "Extend the destination address using the location input help"
I don't want user to enter detail of address trip destination.
how to avoid this?
thanks
Edited by: nzworld on Apr 29, 2011 5:42 AM

Hi,
If you are using ESS and you get the warning message when you enter details for a particular expense type. Please follow the config and hide the location details. Then you will not get this error message.
SAP Customizing Implementation Guide > Financial Accounting (New) > Travel Management > Travel Expenses > Dialog and Travel Expenses Control > Dialog Control > Field Control for Additional Receipt Information.
Enter your trip provision variant, select the expense type for which you dont want to enter the location details and then select details. Search for the variable location, select hide radio button and save.
Please let me know if you have further clarifications.
Regards,
Raj

NAT ASA destination address

Hi
I am using a ASA 5540 running version 7.2(3) and would like to pass all http and https requests coming from the inside of the ASA to an external proxy server on the internet (All request need to pass to port 8080). I've tried using static commands but can only seem to NAT on the inside source address and not the destination address. Have also tried the same using dynamic NAT but again can only NAT on the source address.
Is there a way of NATing the destination address when coming from the inside of firewall?
Alternatively, if anyone can suggest another way of diverting http requests to a proxy server on the internet that would be appreciated.

It seems that when using the ACL in combination with the static translation statement (amounting to static policy NAT), the number of "real" addresses to be translated (as specified in the ACL) needs to equal to the number of addresses used for translation (which is only 1 address).
For example, my Cisco ASA 5505 took gave no errors when I entered the following:
Static Policy Nat - Accepted by ASA w/ no errors - (1 to 1 mapping of 1 real address to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip host 172.16.0.2 host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above policy static nat translates the real source address of 172.16.0.2 to 192.168.1.253 when 172.16.0.2 attempts connections to 74.125.45.105
Notice that there is a 1 to 1 mapping of the "real" address of 172.16.0.2 to the mapped address of 192.168.1.253.
However, in the past I also wondered if I could translate more than one real addresses and map them to one global address using the ACL and static nat combo (which amounts to static policy nat). But I have not been able to get that to work. For example, entering the following provided me with the "global address overlaps with mask" error.
Static Policy Nat - Rejected By ASA w/ error of "global address overlaps with mask" - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit ip any host 74.125.45.105
static (inside,outside) 192.168.1.253 access-list staticPOLICYnat
The above configuration was rejected by my ASA 5505 with an error of "global address overlaps with mask"
In my experience, it is, however, possible to map/translate more than one "real" IP addresses to one mapped/translated IP address using dynamic policy NAT. So for example, the following was accepted by my ASA with no errors.
Dynamic Policy Nat - Accepted by ASA w/ no errors - (many to 1 mapping of multiple real addresses to 1 mapped address)
access-list staticPOLICYnat line 1 extended permit tcp any host 74.125.45.105
nat (inside) 2 access-list staticPOLICYnat
global (outside) 2 192.168.1.253
If anyone knows how to translate or map multiple IP addresses to a single IP address using static policy NAT, please do share.
Best Regards,
David

Natting of Destination Address

Is is possble to nat the destination address. What I am trying to do it change DNS servers. I would like to have traffic going to the old address be natted but traffic going to the new address not be natted. Finally if the DNS devices generates traffic it would not be natted.

I understand it may be tricky, that is why I posted it. The DNS server is an internal server so from the router point of view I can make it either inside or outside. Currently it is connected directly to a 6509, but the thought is to put a 3640 between the DNS server and the 6509 and using static routes on the 6509 direct traffic for either address to the 3640 and then to the new server. My thought was to do nating on the 3640, but as I indicated I have not be able to get the router to change or nat the destination address and also not to nat traffic to the new address or new traffic coming from the DNS server.
If you are someone could give a specific config or point me to a cisco document that explains how to do this it would be great.

"Invalid Destination Address" for MMS messages

I got an HTC One M8 about a month ago, and everything has been working great. However, the last 2 or 3 days, I haven't been able to send MMS messages. I know that the numbers are correct, because I have been grabbing them straight from my contacts, and I have triple checked them. I've tried about 5 different pictures with 5 different contacts, and every time I do, a red triangle with an explanation point in the middle comes up saying "invalid destination address". I have no idea what happened, as it's been working up until the last few days. I have tried with and without WiFi, force stopped my messages and cleared the cache. Nothing works. Can anyone help, please?

RDSHARP39, thanks for trying all of those steps for us. I want to make sure that we get the device back up and running like it is suppose to. Are you able to receive picture messages from your contacts? Have you been able to power off the device and pull the sim card out for a good 10-15 seconds: http://vz.to/1B3J1vX After that time frame please place the sim card back into the device and re-try sending a picture message. Keep us posted.
KevinR_VZW
Follow us on Twitter @VZWSupport

Configuring the port of the syslog destination address

Hello,
Is there a way to configure not just the internet address, but also the port number, to which the AEBS sends logging information?
The "Syslog Destination Address" field doesn't accept the ":port"-style address syntax. But I was wondering if there is a hidden workaround, like doing Option-click to expose a larger number frequencies selections.
Why do I care? For diagnostic purposes, I would like to enable the logging feature on my AEBS 802.11n and receive the logs on an OS X box. The app LogMaster can act as a syslogd daemon. The problem is it can't listen at the default port 514, since OS X's built-in syslogd daemon uses that port. This is despite the fact the built-in syslogd doesn't listen for log messages from the network and cannot be configured to do so without hacking inside the /System directory.
Any thoughts?

The configurations for extend the CoS value to teh ip phone port looks rigth. The fact that you have to unplug the phone for it to work seems to suggest that this is an issue with the phone. Is it running the latest phone load? What kind of switch is this?

Unable to extract bcc address from incoming mail

Hello all,
1>i am facing problem in extracting BCC address from incoming mails .
2>when i am trying sending mails in BCC address to otherdomain i am preety successful but when i try sending BCC on my own domain i am not able to receive it and hence extract bcc address.
Please ,if any of u guys have solution for my problem ,reply immediately.
bobby

From RFC2822.
The "Bcc:" field (where the "Bcc" means "Blind Carbon Copy") contains addresses of recipients of the message whose addresses are not to be revealed to other recipients of the message. There are three ways in which the "Bcc:" field is used. In the first case, when a message containing a "Bcc:" field is prepared to be sent, the "Bcc:" line is removed even though all of the recipients (including those specified in the "Bcc:" field) are sent a copy of the message. In the second case, recipients specified in the "To:" and "Cc:" lines each are sent a copy of the message with the "Bcc:" line removed as above, but the recipients on the "Bcc:" line get a separate copy of the message containing a "Bcc:" line. (When there are multiple recipient addresses in the "Bcc:" field, some implementations actually send a separate copy of the message to each recipient with a "Bcc:" containing only the address of that particular recipient.) Finally, since a "Bcc:" field may contain no addresses, a "Bcc:" field can be sent without any addresses indicating to the recipients that blind copies were sent to someone. Which method to use with "Bcc:" fields is implementation dependent, but refer to the "Security Considerations" section of this document for a discussion of each. When a message is a reply to another message, the mailboxes of the authors of the original message (the mailboxes in the "From:" field) or mailboxes specified in the "Reply-
To:" field (if it exists) MAY appear in the "To:" field of the reply since these would normally be the primary recipients of the reply. If a reply is sent to a message that has destination fields, it is often desirable to send a copy of the reply to all of the recipients of the message, in addition to the author. When such a reply is formed, addresses in the "To:" and "Cc:" fields of the original message MAY appear in the "Cc:" field of the reply, since these are normally secondary recipients of the reply. If a "Bcc:" field is present in the original message, addresses in that field MAY appear in the "Bcc:" field of the reply, but SHOULD NOT appear in the "To:" or "Cc:" fields.
Bottom line is that bcc fields "should" only contain one address (if any) by the time it is delivered to the recipient. You cannot, with any degree of certainty expect to be able to get a list of e-mail addresses from a bcc field that a bad SMTP implementation may leave lying about.
SH

How to trace SCEP update destination address?

Hi,
I need to trace where is destination address when SCEP downloading definition update file.
Is there a log file which be able to tracking?
Thanks.
Regards, Bar Waelah

C:\Windows\WindowsUpdate.log contains this info. For example, if it's downloading from Microsoft, it will have a line that says something similar to
DnldMgr * Downloading from http://download.windowsupdate.com/msdownload/update/software/defu/2014/01/am_delta_patch_1.165.1973.0_3c1f654cc9b3ec1b4827fb28c1e5d40939bccb3a.exe to C:\Windows\SoftwareDistribution\Download\2d1cbf3ecbd4db8ae6985d7c70a5c367\3c1f654cc9b3ec1b4827fb28c1e5d40939bccb3a
(full file).

Trouble getting IP address from DHCP-enabled router

I've recently set up a LinkSys WRT54G wired/wireless router on a home network that has a wired Windows XP machine and a wireless PowerBook with AirPort.
The WRT54G assigns network addresses using DHCP. The PowerBook is able to find the wireless network established by the WRT54G, but doesn't get an IP address from it.
The router seems to be behaving correctly, so I'm guessing there's a problem in the PowerBook setup somewhere. Any ideas?

Double-check your AirPort's settings:
System Preferences > Network > Show > Network Port Configurations
- Verify that an AirPort option exists. If it does not, click "New" to create one. (Note: If you are unable to create an AirPort configuration, the AirPort card in your computer either doesn't exist or it is not recognized.)
- Verify that AirPort is "On" (checked)
- Verify that AirPort is at the top of the list. If it isn't, you can drag it to the top.
Systems Preferences > Network > Show > AirPort
AirPort tab
- By default, join: Automatic
TCP/IP tab
- Configure IPv4: Using DHCP
- Configure IPv6: Automatically or Off
Proxies tab
- Configure Proxies: Manually
- Select a proxy server to configure: <All proxies should be unchecked unless you specifically require a proxy for Internet access.>
- Exclude simple hostnames (unchecked)
- Bypass proxy settings for these Hosts & Domains: <leave blank>
- Use Passive FTP Mode (PASV) (checked)

Exclude destination address from sig

Similar Messages

Maybe you are looking for