topic Re: CISCO IPS 4255 in Network Security

CISCO IPS 4255

r.barba — Sun, 10 Mar 2019 11:39:47 GMT

Hi Friend

I have a Cisco IPS 4255, and I put all the upgrades that Cisco recomend. So, I put the ARES signature with TCP RESET like the action, but the ARES is working without the problem, and I need to stop these traffic. How can I stop the ARES P2P traffic.

I will wait your answer.

Regards

Rafael Barba

Re: CISCO IPS 4255

rhermes — Fri, 12 Jun 2009 17:35:38 GMT

Is your sensor in-line or sniffing in promiscious mode? If it is in-line then you can drop the packets instead of sending a TCP Reset. If your sesor is promiscious, then you need a method of transmitting those resets back into the traffic stream.

Re: CISCO IPS 4255

r.barba — Fri, 12 Jun 2009 20:09:22 GMT

Hi friend thank you for your answer, my sensor is in-line mode, and I have configured the signture with both actions.

TCP reset and deny inline packet???, Should I change the action to other???, please tell me wich one???

Regards

Rafael Barba

Re: CISCO IPS 4255

rhermes — Fri, 12 Jun 2009 21:40:35 GMT

If your sensor is physically in-line then you only need to drop. Are your ARES signatures firing?

Check your alert log with "show event alert past 01:00" to see the past 1 hour of signature alerts.

Re: CISCO IPS 4255

r.barba — Fri, 12 Jun 2009 23:05:27 GMT

Hi friend.

Thank you for your answer, You know that the ARES signatures is not firing, I don not why??? I am sending 2 pictures ipslog1.jpg (is my signatures configuration), ipslog2.jpg (is the action configuration), What must I do in order to fix this issue.

Regards

Rafael Barba

Re: CISCO IPS 4255

r.barba — Wed, 24 Jun 2009 18:43:40 GMT

Hi friend.

Do you have any answer, about hi can I block the ARES with the IPS 4255??, I sent you my signature configuration, but I did not receive nothing. Could you help me??

Regards

Rafael Barba

Re: CISCO IPS 4255

michael.d.brown — Wed, 01 Jul 2009 06:11:51 GMT

check to see if your ARES is triggering that IPS signature.