IPS/IDS whitelist

[Johnfnadez]

Hi Merakiers!

I need to apply whitelist rules in my IPS/IDS rules to specific IP, but I cannot have the option and I`m wondering if anyone knows how to do it, bc I`m just seeing the option to whitelist Rules and not IP wich I think that is very unsecure...

[CptnCrnch · Accepted solution]

Just believe what you‘re seeing: you‘re able to whitelist specific IPS rules, but not IP addresses.

On the other hand, it‘d be a real burden with „real“ Firepower or Snort alone.

[BrechtSchamp]

I agree, whitelisting IPs would be very insecure.

[trick227]

I don't agree. Only being able to whitelist a Signature is like taking a sledghammer to crack a nut. We are seeing false positives caused by signatures, so being able to whitelist based on a source and destination ip adress would be a really good idea. At the moment I have 2 options. Don't whitlelist and keep seeing the same false positive being flagged in security events  (which incidently means a ticket is raised every time) or whitelist the signature but then potentially miss a a true positive event (which really is not what I would do).

[Cb3dwa]

Same it's crazy, we have so many issues with this. 

Checkpoint, juniper can all whitelist a IP so how come meraki cannot. 

Sort it out 

[Cb3dwa]

Why do you think this is insecure ? 

Whitelist a signature will let any host through, whitelistimg a IP to allow one trusted host through 

[Cb3dwa]

Pen testers must love meraki

[JAIT]

agreed with @trick227. We are having several SSH_EVENT_RESPONSEFLOW IDS Alert between two endpoints that communicate over the SDWAN. We need to whitelist the source/destination ip addresses and not the whole event.