Cisco IOS Security Command Reference

policy-map type control mitigation
policy-map type control mitigation
Syntax Description
SEC-1432
Cisco IOS Security Command Reference
Security Commands
To configure a mitigation type policy map for TIDP Based Mitigation Services (TMS), use the
policy-map type control mitigation command in global configuration mode. To remove the policy map
from the router configuration file, use the no form of this command.
policy-map type control mitigation {name}
no policy-map type control mitigation {name}
Command Default A mitigation type policy map is not configured.
Command Modes Global configuration
Command History
name Name of the mitigation type policy map.
Release Modification
12.4(6)T This command was introduced.
Usage Guidelines The mitigation type policy map is used to configure a mitigation type service policy (TMS Rules Engine
configuration). The mitigation type policy map is configured on only the consumer. Entering the
policy-map type control mitigation command places the router in policy-map configuration mode.
The mitigation type policy map is configured to bind mitigation type class and parameter maps together,
creating a mitigation type service policy. The mitigation type class map is configured to match a class
of traffic to a primitive and priority level. The mitigation type parameter map is configured to set the
next-hop variable for a redirect mitigation enforcement action.
Attaching the Policy Map to the Global TMS process
The mitigation type service policy is activated by attaching the mitigation type policy map to the TMS
type policy map in policy-map class configuration mode. The TMS type policy map is then attached to
the global consumer configuration by configuring the service-policy command in TMS consumer
configuration mode.
Examples Blackhole Rule Example
The following example configures the Rules Engine to send priority 5 redirect threat mitigation traffic
to a null interface (black hole):
Router(config)# parameter-map type mitigation MIT_PAR_1
Router(config-profile)# variable RTBH NULL0
Router(config-profile)# exit
Router(config)# class-map type mitigation match-all MIT_CLASS_1
Router(config-cmap)# match priority 5
Router(config-cmap)# match primitive redirect
Router(config-cmap)# exit
January 2008