Network Security

I created a drop rule, dest and src ip's are "ANY", and the hostnames as seen in MARS. I chose to "drop" as action...not "log to db only". The event is "Inactive CS-MARS reporting device, device is "ANY", severity is "ANY", time range is "ANY" I ...

Hi, we have an issue with our client's IDS4215 presently it is using v5.0 but the customer prefer to downgrade to 4.1, which image/service pack should I download first?TIA

Remote users using Cisco VPN 4.2 connect successfully to a Cisco Pix 515 (ver. 6.3). The client is configured to allow Transparent Tunneling and Local Lan access, but once connected to the Pix, these two options are disabled. What configuration chang...

Hi,I have an issue with routing in PIX firewall. we have three DMZs in total. One DMZ for Public servers like proxy, web. Two DMZs are for a 3rd party server connection using Lease line. The problem lies in this 3rd pary area.The communication with t...

Hi,We have a CS-MARS 100 with the last 4.2.1 and I've configured several reports to be sending by email. I'd like to change the default subject that it's shown as "System Scheduler (scheduler)" in the email client (Outlook, p.e.) and if it's possible...

Can I build a signature (and if so can you walk me through how) to alert me of any traffic containing "filename.exe"?So that for example if an email was on its way to our mailserver with such a file attached or a user was downloading such a file via ...

Hey guys, this may be a silly question but what are the HEX numbers after the ACL all about? Can you use them to tie the ACCESS list hit with the line in the ASA? That would be cool. Thanks. access-list inside-in line 8 extended permit tcp any any eq...

When I try to run the CSM Client from my laptop over a vpn the client always hangs when it says synchronzing with DCR. I believe it might be an MTU issue but can not test at the moment. Has anyone had trouble with this?

Hi,Customer is asking for a solution wherein ASA will be in transparent mode. 2 of the interfaces will fall in Admin context while other two will be part of a new context, say Context Traffic1. Now as he is also buying AIP SSM module with the boxes h...

Hello,I've got two ASA5520's I want to be setup in active/active failover mode. To do this I will need to configure security contexts. However, I wish to use ospf routing on the ASA's. OSPF is apparently not supported when ASA's are in multiple co...

Customer has a T1 for internet coming into a 1700 series router. Ethernet connection goes into an ASA 5510. I have their data network connected via Eth0/2 and a guest network connected via Eth0/1. The users on the data network can access everythin...

I installed an agent kit to my laptop to test a group setup and now when i try to uninstall it from my pc a message pops up saying that the csa service can not be stopped. I tried to find my host in the CSA MC but i could not. Has anyone ran across...

I am looking for an explanation of the changes made to the sig 1330 with release 248. Many of the Normalizer subsigs did not produce alerts before. Now they do and my sensors are firing a ton of 1330 events. Any Cisco Signature Engineers able to resp...

Hello I need to give access to all my users to a external ldap server to query email addresses, what is the command that I need to run?my internal subnet is 10.1.0.xthanks for your replies