topic Re: PIX 'shun' command in Network Security

PIX 'shun' command

m.mohanasundaram — Fri, 21 Feb 2020 08:08:27 GMT

Hello Guys,

This command is not working as expected.I configured;

pix(config)# shun 172.16.5.100 144.10.55.1 0 23 tcp

Shun 172.16.5.100 successful

pix(config)#

This command blocks all traffic from 172.16.5.100 to "all" destinations. My understanding is that it should only block traffic from 17.16.5.100 to 144.10.55.1 destined for telnet port, 23. But it blocks all traffic originated from 172.16.5.100, including ICMP.

Any thoughts?

TIA,

Mohan

Re: PIX 'shun' command

alexr — Sat, 14 May 2005 09:57:24 GMT

Hello Mohan,

As far as i remember from PIX documentation shun command blocking all traffic originated from IP.

So all the rest of command is ignored.

The PIX shun command always shuns the source address regardless of whether or not the additional connection information is provided.

I think in this case better to use access-list statements.

Alex

Re: PIX 'shun' command

a.alekseev — Sat, 14 May 2005 16:23:30 GMT

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801cd841.html#wp1026366