IDSM-2 host blocks

Garrison Botts — Sun, 10 Mar 2019 12:54:21 GMT

Hey guys..... I'm having an issue and need some help....

My inline IDSM-2 is blocking internal hosts from accessing the internet. When I run a report to try and identify "why", they don't show up. Using IME, I can see they are in the "denied attackers" section. How can I find out what's causing it?

thanks...

IDSM-2 host blocks

jocamare — Wed, 27 Feb 2013 05:36:47 GMT

Remove only one of the denied hosts and monitor the logs that have its IP [ IME is great doing this ].

If you identify the host as a malicious unit, move it back to the list.

If you find out that the IPS is reacting to false positives, you can check the signatures that triggger and see how reliable they are.

A packet capture is also a great idea to see what is the unit is seeing and understanding why it is blocking it.

Finally, if you just don't want this host to be affected by the IPS rules, simply create an event action filter for it.

topic IDSM-2 host blocks in Network Security

IDSM-2 host blocks

IDSM-2 host blocks