topic 4240 Multi-Interface Shun question in Network Security

4240 Multi-Interface Shun question

HEATH FREEL — Sun, 10 Mar 2019 09:19:31 GMT

Here is the scenerio

I have a 4240 with 8 interfaces. I have 5 Internet accesses - one sensing interface per internet access.

Is it possible to set up blocking for each specific firewall based on where the attack came from.

I do not want to block the attacking IP from all 5 internet accesses - only the one that the attack originated on.

Is this possible? Thanks in advance.

Re: 4240 Multi-Interface Shun question

marcabal — Thu, 10 Mar 2005 22:54:09 GMT

Not at this time.

Currently all shuns will be applied to all devices.

(Unless the address in the Never Shun list, then it will not be applied to any of the devices)

If you would like to see this in a future release then ask your Cisco account manager or the TAC to submit a DDTS Enhancement request to have this feature added to the sensor.

Re: 4240 Multi-Interface Shun question

ajay_dand — Wed, 16 Mar 2005 12:02:00 GMT

That's a pretty useful feature. There are other host of features, I would like to see on the IDM & IDS-MC. Could somebody point to a way I can properly submit a DDTS Enhancement request?

Re: 4240 Multi-Interface Shun question

rwassom — Wed, 16 Mar 2005 16:25:58 GMT

I assume we are talking about a theoretical situation here, since the 4240 only has 4 sensing ports and 1 management port. There are currently no option cards available to upgrade the 4240 to 8 sensing interfaces.

-rw

Re: 4240 Multi-Interface Shun question

HEATH FREEL — Wed, 16 Mar 2005 18:18:03 GMT

Initially I was not talking theorerically- since I was looking to deploy 8 Interfaces. The documentation on the 4240 is misleading.

it says the following.

Four 10/100/1000Base-Tx monitoring interfaces (allowing a total of 8 monitoring interfaces) or four 1000Base-Sx fiber (available soon).

I took that to mean that the Fiber was available soon.

Either way - with four interfaces all sensing - the question I asked still applies and I have been told it is not supported.

Re: 4240 Multi-Interface Shun question

rwassom — Fri, 18 Mar 2005 21:54:08 GMT

I apologize for the misleading documentation. I interpreted it the same way you did, and have already attempted to address this with the appropriate folks. Hopefully we will get the documentation updated soon to accurately reflect available options, which should prevent further confusion.

-Rusty