topic Re: IDS PIX shunning in Network Security https://community.cisco.com/t5/network-security/ids-pix-shunning/m-p/156134#M609512 <HTML><HEAD></HEAD><BODY><P>You don't really configure the PIX, you just need to configure the sensor (via CSPM) to do blocking. When the sensor detects a signature that is set up for blocking, it will telnet/SSH to the PIX and add a "shun" command that will drop all packets from the signature source.</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch03.htm#57747" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch03.htm#57747</A></P><P></P><P>Noe that for a PIX, there is no interface to apply this to, the shun get's applied to all incoming packets on all interfaces.</P><P></P><P>You then need to modify the particular signature so that one of it's Actions is to block. </P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch05.htm#xtocid263714" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch05.htm#xtocid263714</A></P><P></P><P>BTW, I would seriously consider upgrading your signatures, you are about 25 signatures releases and 4 service packs behind now.</P></BODY></HTML> Fri, 14 Feb 2003 01:05:50 GMT gfullage 2003-02-14T01:05:50Z IDS PIX shunning https://community.cisco.com/t5/network-security/ids-pix-shunning/m-p/156133#M609510 <P>How do i configure the PIX for IP blocking when my IDS detect an anomalous activity? </P><P>My IDS version is 3.0(1)S4</P><P>I have a CSPM version 2.3.3i</P><P></P> Fri, 21 Feb 2020 06:33:25 GMT https://community.cisco.com/t5/network-security/ids-pix-shunning/m-p/156133#M609510 rolalo 2020-02-21T06:33:25Z Re: IDS PIX shunning https://community.cisco.com/t5/network-security/ids-pix-shunning/m-p/156134#M609512 <HTML><HEAD></HEAD><BODY><P>You don't really configure the PIX, you just need to configure the sensor (via CSPM) to do blocking. When the sensor detects a signature that is set up for blocking, it will telnet/SSH to the PIX and add a "shun" command that will drop all packets from the signature source.</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch03.htm#57747" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch03.htm#57747</A></P><P></P><P>Noe that for a PIX, there is no interface to apply this to, the shun get's applied to all incoming packets on all interfaces.</P><P></P><P>You then need to modify the particular signature so that one of it's Actions is to block. </P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch05.htm#xtocid263714" target="_blank">http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch05.htm#xtocid263714</A></P><P></P><P>BTW, I would seriously consider upgrading your signatures, you are about 25 signatures releases and 4 service packs behind now.</P></BODY></HTML> Fri, 14 Feb 2003 01:05:50 GMT https://community.cisco.com/t5/network-security/ids-pix-shunning/m-p/156134#M609512 gfullage 2003-02-14T01:05:50Z