Cisco Cisco Firepower Management Center 4000

Admin/Intrusion Admin

Select 

The Intrusion Policy page appears.

Click the edit icon (

) next to the policy you want to edit.

If you have unsaved changes in another policy, click 

 to discard those changes and continue. See 

 for information on saving unsaved changes in another 

policy.

The Policy Information page appears.

Click 

 in the navigation panel on the left.

The Advanced Settings page appears.

You have two choices, depending on whether 

under Performance Settings 

is enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The Latency-Based Packet Handling page appears.

A message at the bottom of the page identifies the intrusion policy layer that contains the configuration. 
See 

 for more information.

See the 

 table for recommended minimum 

 

settings.

Optionally, click 

 at the top of the page to display rules 

associated with individual options.

Click 

 to return to the Latency-Based Packet Handling page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

You can balance security with the need to maintain latency at an acceptable level by enabling rule latency 
thresholding. Rule latency thresholding measures the elapsed time each rule takes to process an 
individual packet, suspends the violating rule along with a group of related rules for a specified time if 
the processing time exceeds the rule latency threshold a configurable consecutive number of times, and 
restores the rules when the suspension expires.

Rule latency thresholding measures elapsed time, not just processing time, in order to more accurately 
reflect the actual time required for the rule to process a packet. However, latency thresholding is a 
software-based latency implementation that does not enforce strict timing.