Cisco Cisco Firepower Management Center 4000

The IP Defragmentation page appears. A message at the bottom of the page identifies the intrusion policy 
layer that contains the configuration. See 

 for more 

information.

Optionally, you can modify the setting for 

 under 

.

You have two options:

Add a new target-based policy. Click the add icon (

) next to 

 on the left side of the page. The 

Add Target pop-up window appears. Specify one or more IP addresses in the 

field and 

click 

. 

You can specify a single IP address or address block, or a comma-separated list of either or both. 
You can create a total of 255 target-based policies including the default policy. For information on 
using IP address blocks in the FireSIGHT System, see 

A new entry appears in the list of targets on the left side of the page, highlighted to indicate that it 
is selected, and the Configuration section updates to reflect the current configuration for the policy 
you added.

Modify the settings for an existing target-based policy. Click the configured address for a policy you 
have added under 

 on the left side of the page, or click 

.

Your selection is highlighted and the Configuration section updates to display the current 
configuration for the policy you selected. To delete an existing target-based policy, click the delete 
icon (

) next to the policy you want to remove.

Optionally, you can modify any of the options under 

.

Optionally, click 

 at the top of the page to display rules associated 

with individual options.

Click 

 to return to the IP Defragmentation page.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.

Protection

Before sending captured packets to a preprocessor, the system first sends the packets to the packet 
decoder. The packet decoder converts packet headers and payloads into a format that preprocessors and 
the rules engine can easily use. Each stack layer is decoded in turn, beginning with the data link layer 
and continuing through the network and transport layers. For more information on packet decoding, see 

Note that you must enable packet decoder rules, which have a generator ID (GID) of 116, if you want 
these rules to generate events. A link on the configuration page takes you to a filtered view of packet 
decoder rules on the intrusion policy Rules page, where you can enable and disable rules and configure 
other rule actions. See 

 for more information.

If no preprocessor rule is mentioned, the option is not associated with a preprocessor rule.