Network Security

Hi,I would like to create a signature which fires when a server reports HTTP Not found.For testing purposes I have used space ([\x20]) for matching regexp. It does not work. When I set the direction from "from-service" to "to-service" it works. Does...

Which analog PIX's command - debug packet src/dst x.x.x.x netmask y.y.y.yon ASA device?

Hello,I have a following question regarding the tunnel groups on ASA.We have multiple user groups with different access level needs and a user can be part of a multiple groups.Currently ASA (or VPN 3000) allows to lock a user to only one group. I see...

Hi,I'm new to the realm of firewalls but I am wandering if the Cisco PIX 501 has any capability to send out monthly emails showing bandwidth usage?Thanx in advance.

Hello,I need apply diferent security policys for diferent user. I have two Network Access Profiles with diferent advanced filtering attribute UserName, but this configuration don?t work. I have debug radius authentication in NAC switch and i see that...

There seams to be a problem with the signature Net Flood TCP. The Cisco Intrusion Prevention sensor is installed in promiscuous mode and is at version 5.1(2) S247.0. The signature is enabled for rate 0 and to produce at alert.signatures 6920 0 status...

Hi friends,Just wanted to know a few things. The platform is confined to ASA 5540 and version 7.01.Can I not telnet into one of standby's interface Ip's? This is just to check if it has the same configuration as the active one? I just want to escape ...

Hello, I have two Pix 515Es in a failover configuration. The pixes are running 6.2(2). We have an issue where the primary will fail to the secondary and then later the secondary will fail back to the primary. This issue sometimes is happening 2 t...

What does it mean when an alert lists 0.0.0.0 as the source that triggered the signature?

To the Cisco IPS team, thank you for updating the IEV to 5.2. From what I've seen so far, it's a very nice improvement to 5.1.Email alerts are very nice to have. The only thing really missing from a SMB perspective is better reporting. Top 10's ar...

Our campus policy for dorms(college) is to not allow inbound connections, however it appears the latest version of ARES gets around that. We can now identify traffic as the start of a new connection as: The connect packets are always 46 bytes long,...

Hi all,I am trying to use Output interpreter through RME. When i use the button "analyze output" in the netshow section of RME it does not work. The NetShowClient.log:[ mar sep 19 18:46:37 BST 2006 ],INFO ,[Ajp13Processor[9009][6]],com.cisco.nm.rmen...

Hi I am slightly confused about this kit. We just want to implement ASA 5510 as IDS at the moment ;doing no more than just watching Traffic from one Vlan. My questions are1) I have configured it in Promis. mode. I have configured Port Span on the sw...

Hi ASA 5510 with OS ver 7.2(1), it is not allowing to pass the traffic thru tunnel for more than two RVPN tunnels. Ping, RDP everything works fine for 2 tunnels. From 3rd tunnel will get established, but will pass only sent traffic, no return traffi...