topic Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme in Network Security

denyPacketRequestedNotPerformed+denyFlowRequestedNotPerformed

wmchan1979 — Sun, 10 Mar 2019 11:42:41 GMT

I am seeing "denyPacketRequestedNotPerformed+denyFlowRequestedNotPerformed" on the Cisco IPS.

The Cisco IPS is running version 6.1(2)E3. The IPS is running inline mode. We are seeing sigID 3616 subsigID 4 was triggered and the above action was noticed. The action taken was set to deny packet inline. However, we are seeing the above message.

Anyone can assist on this issue? Appreciate for the help.

Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme

rand.hall — Wed, 22 Jul 2009 11:09:07 GMT

See my similar question around Jul-8.

I thought I was in inline mode but was in promiscuous mode.

I have the ASA daughter card. I read the IPS docs upside down and sideways looking for how to get into inline mode. There is a single and (to me) obtuse one line reference that points you to the ASA docs. Indeed, that's where I found the relevant info.

Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme

wmchan1979 — Wed, 22 Jul 2009 23:36:08 GMT

How could we determine if the IPS (daughter card in the ASA) is running promicuous mode or inline mode? Would you be able to send me the doc that you have so that I can read it further? Thanks.

Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme

rand.hall — Thu, 23 Jul 2009 12:32:25 GMT

This is the section of the docs you're looking for:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_ssm.html

On the ASA:

show service-policy ips

or grep your ASA config for the policy map command:

ips {inline | promiscuous] [fail-close | fail-open}

Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme

wmchan1979 — Mon, 27 Jul 2009 21:46:14 GMT

Thanks. I will give it a try and let you know the findings.

Re: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerforme

wmchan1979 — Sun, 02 Aug 2009 11:03:30 GMT

Hi rand.hall,

The IPS was actually running on promiscuous mode as what you predicted. We had changed it to the inline mode now. Thanks for your help. 🙂