How to Disable Signatures for a Specific Host

Overview

This document describes the steps to disable signatures for traffic for a specific host(s).

Steps:

1. Navigate to Objects > Security Profiles > Vulnerability Protection.
2. Create a new Profile or edit an existing one.
3. Under Exception check the "Show all signatures" and than filter the needed signature (for example 30042).
   
4. The default action for this signature is "reset-both". However, for the IP address 10.10.10.10, an exception is created and will not reset the connection when there is a match to the signature, but will allow the traffic. This is done by clicking on the IP Address Exemption Field, adding the IP address in the form, and changing the action to allow. If the exception is needed for multiple IP addresses, add them also in the form. Notice that the count in the IP column will increase.
   
   Don't forget to check the Enable column, so that the exception is enabled for that Vulnerability Profile.
   
5. After the change, verify that the change took effect. Under the Profile itself, there should be an increase count in the exception part.
   
6. If this is a new Vulnerability Profile, add it to the applicable security rule.
   

Note: Vulnerability profile was used in the example above, but the same steps can also be applied to spyware profiles.

owner: ialeksov