topic IPS Errors in Network Security

IPS Errors

Bethuelle — Sun, 10 Mar 2019 12:24:58 GMT

Hi to ye all,

I an ASA 5520 with an AIP-SSM-10 module. Blocking Host Connection has been activated on some signatures and I get the following errors in the diagrams below. I'll like to know their cause and what I can do to solve them

thanks for your help

IPS Errors

rhermes — Mon, 18 Jul 2011 16:55:11 GMT

It looks like you are trying to shun to a PIX firewall.

Have you added the PX to the allowed hosts and the PIX's TLS and SSH keys in the sensor?

Allowed Hosts:

conf t

service host

access-list 192.168.0.1/24 (ip address of your PIX)

exit

exit [yes]

config

Adding TLS and SSH keys:

conf t

ssh host-key 192.168.0.1

tls trusted-host ip-addess 192.168.0.1

- Bob

Re: IPS Errors

Bethuelle — Wed, 20 Jul 2011 07:14:04 GMT

Hye rhermes,

no i haven't done all that. it's an ASA 5520 firewall

IPS Errors

rhermes — Wed, 20 Jul 2011 15:23:39 GMT

Even if you are shunning to an ASA you will need to perform those tasks.

- Bob

IPS Errors

Bethuelle — Thu, 21 Jul 2011 10:51:26 GMT

Hye Bob,

When i try generating the trusted key I get this error

IPS Errors

Bethuelle — Thu, 21 Jul 2011 11:10:16 GMT

Also I have been encountering the following phenomena. See screen captures

In the 1st Screen Capture, it says the source address couldn't be blocked but it was finally blocked so i do not understand what caused that message.

As for the 2nd Screen Capture, when Connection Block Enabled is at True, the Host is not blocked but when it'a at false, the host is blocked. I do not quite understand.

Thanks for all your tips in advance.

bye

Re: IPS Errors

rhermes — Thu, 21 Jul 2011 13:50:35 GMT

Don't worry about the TLS connections, those are used between sensors when you make one sensor a Master Blocking Sensor (they need a trust relationship). Is you sensor ssh'ed into your firewall?

you can check with this command (or there should be soem GUI version of this as well). Look for the bold active:

IDSM-slot6# sh stat network-access

Current Configuration

LogAllBlockEventsAndSensors = true

EnableNvramWrite = false

EnableAclLogging = false

AllowSensorBlock = false

BlockMaxEntries = 250

MaxDeviceInterfaces = 250

NetDevice

Type = Cisco

IP = 10.0.0.113

NATAddr = 0.0.0.0

Communications = ssh-3des

ResponseCapabilities = block

BlockInterface

InterfaceName = vlan101

InterfaceDirection = out

BlockInterface

InterfaceName = vlan102

InterfaceDirection = out

State

BlockEnable = true

NetDevice

IP = 10.0.0.113

AclSupport = uses Named ACLs

Version = 12.2

State = Active

- Bob

IPS Errors

Bethuelle — Thu, 21 Jul 2011 15:06:18 GMT

ASA

interface GigabitEthernet0/1.1

nameif inside

security-level 100

ip address 192.168.0.1 255.255.255.128

ASA (Config): ssh 192.168.0.20 255.255.255.255 inside

AIP-SSM

Sensor (Config) # ssh host-key 192.168.0.1

Find above the existing configuration in my ASA5520 and AIP-SSM-10

I have also added the ASA 5520 (192.168.0.1) to the list of Allowed Hosts