Configuring the SIP Preprocessor
|
This section applies to Snort 2 preprocessors. For information on Snort 3 inspectors, see https://www.cisco.com/go/snort3-inspectors. |
Procedure
| 1 |
Choose , and then click Network Analysis Policy or , and then click Network Analysis Policies.
|
||
| 2 |
Click Snort 2 Version next to the policy you want to edit. |
||
| 3 |
Click Edit ( If View ( |
||
| 4 |
Click Settings in the navigation panel. |
||
| 5 |
If SIP Configuration under Application Layer Preprocessors is disabled, click Enabled. |
||
| 6 |
Click Edit ( |
||
| 7 |
Modify the options described in SIP Preprocessor Options. |
||
| 8 |
To save changes you made in this policy since the last policy commit, click Policy Information, then click Commit Changes. If you leave the policy without committing changes, cached changes since the last commit are discarded if you edit a different policy. |
) next to the policy you want to edit. 
) appears instead, the configuration belongs to an ancestor
domain, or you do not have permission to modify the
configuration.What to do next
-
If you want to generate events and, in an inline deployment, drop offending packets, enable SIP preprocessor rules (GID 140). For more information, see Setting Intrusion Rule States.
-
Deploy configuration changes.