Network Security

Firewall Migration Tool v7.0.0.1 now live!

Enabling our customers to leverage their install base and take them to the next level with Cisco Secure Firewall Threat Defense has always been a key priority. The migration tool is available for download to migrate the configuration on the on-premi...

Resolved! Configuring the Catalyst 6500 Switch for IPS Inline Operation of the IDSM

I understand how to configure the Catalyst 6500 switch so that the monitoring ports are access ports in two separate VLAN's for inline operation. However, I don't see any documentation that describes how the desired VLAN traffic gets forced through ...

PIX 515R problems after software upgrade.

I recently upgraded my PIX from 6.1 to 6.3 and upgraded the PDM. The PIX ran fine for a week and then just stopped passing traffic and could not be polled or connected too. After a restart the PIX will work. This has happened several times sometimes ...

SigEvent Action Filter

I have created a “SigEvent Action Filter” to filter all TCP syn host sweep (3030) from a single host to a defined variable "set of IP addresses". The filter appears to stop alerting on all of the events except the summarized alerts. These alerts are ...

ASA as packet redirector

Hello! (Excuse for my English :)We have a problem of realization of this schemeLAN1(172.16.2.0/24)--- | L3 Switch(192.168.1.2/24)---Packeteer---(192.168.1.1/24)ASA5540(PAT)---Internet | LAN...

Resolved! General 4215 Question

I'm quite a newbie to the IDS 4215 configuration; however, we just received ours in-house and I would like to run through the set-up with some experts prior to an extended test. My question, I have the cables from Fe1/1 and Fe1/2 plugged into two Gig...

IdsImportArchivedData

With vms 2.3, you can use a cli command to import archived data. Each time data is archived, it is writen to a sub directory “~\CSCOpx\MDC\secmon\AlertPruneData\” it begins a new directory with the date and time (date_time) of the archival. Say for i...

Questions on MARS

I believe MARS can collect NetFlow data from Cisco router/switch that supports NetFlow. Can the MARS collect netflow data from Nortel 8600 Passport Switch? I guess my other question would be is NetFlow only a Cisco proprietory, other vendor wont supp...

PIX disallowing new connections

I am using a PIX 501 50 user device and the suddenly the internet started going up and down. Looking at my Syslog entries I found a lot of the following entries:2006-05-02 18:26:41 Local4.Error 192.168.1.1 %PIX-3-305006: portmap translation creation...

IDSM2 VACL configuration

We have Cisco 6500 catalyst running on native IOS 12.1(13) and recently purchased a IDSM2 (5.1). I have succesfully tested it to run on promiscous mode, but I having problem on applying a VACL configuration. I want apply VACL so I could have a contro...

Simulate attack or intrusion to cause a signature trigger

Is it possible to simulate an attck or an intrusion , which will trigger any particular signature id in an IDS model 4250. ( on a host which IDS is sensing ). This will enable us to actually check or see an intrusion on real time dashboard on IdS ...

Filter Signature which is part of a Meta-Signature

What happens to a Meta-Signature if I filter out a single signature within that Meta-signature? Does the Meta-sig still fire or no? I don't want to filter out a signature if it's going to prevent the Meta-sig from firing but I also would like to clea...

2 Different Blocking Devices

Router--FW-DMZ-PIX--Interal NetworkI have a UDS 4215 to monitor all traffic to/from internal Network & use PIX as blocking deviceNow I would like to monitor all traffic in DMZ and use router as blokcing deviceMay I do that?Thanks

Confusing Cisco Doc ??? # of syslog Messages stored in Pix

How many Syslog messages can be stored by PIX if syslog servers are offline ? 100 or 512 ?Cisco Doc Finesse is always saying that it's 100, whereas in Cisco Online Security course v 2.0, it's said (section 3.4.8 Syslog configuration): " ...In the eve...