We are running a Cisco ASA 5510 with the IPS module.
We have an internal server that is preforming a lot of SNMP discovery scans and is being blocked and shutdown by the IPS.
Since I'm in control of this server, and this is an expected behaviour I would like to add an exception to the IPS to prevent this server from being blocked.
I have found the following in the Cisco IPS manager Express tool:
Configuration > sensor_name > Sensor Management > Blocking > Blocking Properties, and click Add to add a host or network to the list of addresses never to be blocked.
However, even after I add the servers IP address here it's still being blocked.
Is there another area that I should be adding this server too?