topic IDSM2 version 4.1 blocking attacks in Network Security

IDSM2 version 4.1 blocking attacks

nmourtzinos — Sun, 10 Mar 2019 09:41:12 GMT

Hello All,

We have set up a IDSM2 version 4.1 on a Cisco Catalyst 6500 switch.

We have configured it using SPAN on specific vlans and if we run a port sweep, we can see the alarms on the IDS viewer.

It is possible to stop any attack by dropping packets/ flows or blocking dynamically the source ip address of the attack ?

Thanks in advance.

Nikos

Re: IDSM2 version 4.1 blocking attacks

Tue, 18 Oct 2005 15:25:32 GMT

When the system detects unauthorized activity, appliances can terminate the specific connection, permanently block the attacking host, log the incident, and send an alert to the IDS manager. Other legitimate connections continue to operate independently without interruption.

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_installation_and_configuration_guide_chapter09186a0080358053.html

Re: IDSM2 version 4.1 blocking attacks

abdel_n — Tue, 18 Oct 2005 18:16:13 GMT

The IDSM-2 as the IDS sensor is allowed to initiate blocking to other devices either through IDM or CiscoWorks VMS (IDS MC), for automatic blocking you just assign block as eventAction for the desired signature and the IDSM-2 will push an VACL to the switch.

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_example09186a00801e8181.shtml