| 5.2 |  | Setting up the Cisco IOS Firewall IDS |
| 5.2.1 |  | Configuration tasks |

| To configure the IOS Firewall IDS on a router and have it report alarms to a Cisco Secure IDS Director, perform the tasks listed in Figure :

- Initialize IOS Firewall IDS on the router - This includes setting the notification type, the router post office parameters, the IDS Director Post Office parameters, the protected network definition, and the maximum queue size for holding alarms on the router.
- Configure, disable, or exclude signatures - This includes setting the spam attack threshold, disabling signatures globally, and excluding signatures by host or network.
- Create and apply audit rules - This includes creating an audit rule for information or attack signatures and then applying it to an interface. Another option is to create an audit rule that excludes hosts or networks and then applying it to an interface.
- Verify the configuration - This includes using available show, clear, and debug commands for IOS Firewall IDS.
- Add the IOS Firewall IDS to the IDS Director map - The IDS-enabled router appears as another sensor on the Cisco Secure IDS home map.