Objectives
The simulator ticks each one as soon as the network meets it.
Rule HTTP-WEB is Trust, and Trust skips Snort: change it to Allow, and put IPS policy WEB-IPS back on it.
WEB-IPS is in detection mode, which only reports: change it to prevention.
Someone disabled rule 1000102 in WEB-IPS to silence an alert: put it back to its default.
Deploy. The attack is dropped, and a normal request arrives.
Before you start
Fix one setting at a time, and send the packet again. show ips-policy WEB-IPS lists every rule’s state. Changing a rule’s action to Trust removes its IPS policy, so that fault hides the other two.
Concept
An access rule reads the address, Snort reads the contents
An access rule allows or blocks by address and port, so it passes an attack on an allowed port. An Allow rule with an IPS policy sends its traffic through Snort, which reads the contents and compares them with its rules. Prevention mode drops what a drop rule matches, and detection mode only reports it, so you can see what a policy would break before you trust it.
