Cisco Cisco Firepower Management Center 2000

Protection

You can create one or more intrusion policies. For example, you can create policies that monitor traffic 
on your network. You can also create policies that you use for testing in a safe network environment, or 
for familiarizing yourself with features such as FireSIGHT Recommended Rules or the different default 
policies provided by Cisco.

When you create a policy, a pop-up window provides immediate access to the features you are most 
likely to configure. You can create your intrusion policy using only the options in the pop-up window, 
or you can save your changes and continue to the advanced intrusion policy editor, where you can 
configure any intrusion policy features.

You can import intrusion policies from other Defense Centers in your deployment. See 

 for more information.

Admin/Intrusion Admin

Select 

.

The Intrusion Policy page appears.

Click 

.

If you have unsaved changes in another policy, click 

 when prompted to return to the Intrusion 

Policy page. See 

 for information on saving unsaved 

changes in another policy.

The Create Intrusion Policy pop-up window appears.

Type a unique name of 50 characters or less that identifies your policy and, optionally, a description that 
differentiates it from other policies.

Specify whether you want the system to drop the packet and generate an event when a packet triggers a 
rule set to Drop and Generate Events in an inline deployment:

To drop the packet and generate an event, select the 

 check box.

To generate an event but not drop the packet, clear the 

 check box.

Note that the system does not drop packets in a passive deployment, including when an inline interface 
is in tap mode, regardless of the rule state or the inline drop behavior of the intrusion policy. For more 
information, see 

, 

, and 

Optionally, select a different Cisco default or custom policy that you want to use as the base policy for 
your intrusion policy from the 

 drop-down list. See 

for more information.

You have the following options:

To exit the pop-up window without creating a policy, click 

.

The Intrusion Policy page appears.

To save your changes, click 

.

The Intrusion Policy page appears.