Suppression commands are standalone commands that reference generators, SIDs, and IP addresses via a CIDR block. This allows a rule to be completely suppressed, or suppressed when the causative traffic is going to or coming from a specific IP or group of IP addresses.
You may apply multiple suppression commands to a SID. You may also combine one threshold command and several suppression commands to the same SID.
The suppress command supports either 2 or 4 options, as described in Table .
suppress gen_id <gen-id>, sid_id <sid-id>, \ track <by_src|by_dst>, ip <ip|mask-bits>
Suppress gen_id 1, sig_id 1852:
Suppress this event from this IP:
suppress gen_id 1, sig_id 1852, track by_src, ip 10.1.1.54
Suppress this event to this CIDR block:
suppress gen_id 1, sig_id 1852, track by_dst, ip 10.1.1.0/24