If not specifically asked on the exam I would set it to "Summarize". I used to do a lot of custom signatures and saw that IPS may create a flood of events to the management application (MARS and the like) when it is set to "Fire All". The alert will be created by every single packet.
Eugene From: [email protected] [mailto:[email protected]] On Behalf Of Vybhav Ramachandran Sent: Monday, November 22, 2010 11:04 PM To: OSL Security Subject: [OSL | CCIE_Security] IPS default event action Hello All, The default Summary mode in many signals is "Summarize". If not specifically asked, what you would set this field to, when configuring a signal. I usually set it to "Fire All". Cheers, TacACK
_______________________________________________ For more information regarding industry leading CCIE Lab training, please visit www.ipexpert.com
