Activating and Deactivating Detectors
You must activate a detector before you can use it to analyze network traffic. By default, all Cisco-provided detectors are activated.
You can activate multiple application detectors for each port to supplement the system’s detection capability.
When you include an application in an access control rule in a policy and that policy is deployed, if there is no active detector for that application, one or more detectors automatically activate. Similarly, while an application is in use in a deployed policy, you cannot deactivate a detector if deactivating leaves no active detectors for that application.
Tip | For improved performance, deactivate any application protocol, client, or web application detectors you do not intend to use. |
Caution | Activating or deactivating a system or custom application detector immediately restarts the Snort process without going through the deploy process. The system warns you that continuing restarts the Snort process and allows you to cancel; the restart occurs on any managed device in the current domain or in any of its child domains. Whether traffic drops during this interruption or passes without further inspection depends on how the target device handles traffic. See Snort Restart Traffic Behavior for more information. |
Procedure
Step 1 | Select . | ||
Step 2 | Click the slider next to the detector you want to activate or deactivate. If the controls are dimmed, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.
|