| 5.2 |  | Setting up the Cisco IOS Firewall IDS |
| 5.2.4 |  | Creating and applying audit rules |

| The following steps describe the packet auditing process with Cisco IOS Firewall IDS : Step 1 – Set the default actions for both information and attack signatures . Use the ip audit info action global configuration command to specify the default actions for information signatures.

Use the ip audit attack action global configuration command to specify the default actions for attack signatures.

Step 2 – Create an audit rule that specifies which signatures should be applied to packet traffic and which actions to take when a match is found.
Use the ip audit name global configuration command to create audit rules for information and attack signature types. Use the no form of this command to delete an audit rule .

Step 3 – Apply the audit rule to an interface.
Use the ip audit interface configuration command to apply an audit rule to a specific interface and for a specific direction. Use the no version of this command to disable auditing of the interface for the specified direction.

- If the audit rule is applied inbound on the interface, packets passing through the interface are audited before any inbound ACL has a chance to discard them. This allows an administrator to be alerted if an attack or reconnaissance activity is under way even if the router would normally reject the activity.
- If the audit rule is applied outbound on the interface, packets are audited after they enter the router through another interface. In this case, the inbound ACL of the other interface may discard packets before they are audited. This may result in the loss of IDS alarms even though the attack or reconnaissance activity was thwarted.

Step 4 – Audit packets
Packets going through the interface that match the audit rule are audited by a series of modules, starting with IP, then either ICMP, TCP, or UDP, and finally, the application level.

Step 5 – Execute the user-configured action(s) if a signature match is found in a module.