An Active Responder policy also contains a list of hosts/networks with the following
classifications:
- Allow Active Responder — Specifies the IP address ranges and subnets that are eligible for Active Response.
- Never Respond — Specifies the IP address ranges and subnets that will never trigger a response.
Typically, include IP addresses internal to your organization in the Allow List,
with critical servers listed in the Never list.
![]() |
Note You can specify a multicast subnet or range in the inclusions and exclusions lists;
however, you cannot specify a single multicast host.
|