| 5.1 |  | IOS Firewall IDS |
| 5.1.3 |  | Response options |

| The Cisco IOS Firewall IDS acts as an inline intrusion detection sensor, watching packets as they traverse the router interfaces and acting upon them in a definable manner. When a packet, or a number of packets in a session match a signature, the IOS Firewall IDS may perform the following configurable actions, as shown in Figure :

- Alarm - Sends an alarm to Cisco Secure IDS Director, Syslog server, or router console, and then forwards the packet through.
- Reset - Sends packets with reset flag to both session participants if it is a TCP session. It then forwards the packet through.
- Drop - Immediately drops the packet.

An alarm is sent when a signature match is detected in a packet and the event is reported to all configured syslog servers. Drop will drop the offending packet only. The default response is alarm. Specifying no action will result in no reaction to the event. It is generally recommended that drop and reset actions be used together.