Network Security

hi, I run CNR 6.2.2 and cmts with subinterface. When one cable modem wants to regester and the following information will appear in CNR log.i have disable dhcp server attribute"vpn-communication" and ignore-optionslike option 82, 220 but the situa...

Hello All,We have deployed VPN's via ethernet and we integrate that via dot1q VLAN's on a subinterface on a GigEthernet. We then make those a member of a specific vrf forwarding VPN for example.interface GigabitEthernet0/1.101 description VPN-CUST1 ...

Can someone please explain briefly when should I use the HTTP/FTP AIC signature engine over any other type?I ask this question because for instance the FTP commands can be looked for in either String TCP engine, Atomic TCP or FTP AIC engine, but whic...

I want to do the following:Only if the target of the attack is MailSrvand the RR > 85--->block attackerIf target is any other host -->don't block===========My problem is that I cannot specify the dst IP in the event action override.So my only choice ...

I am trying to build a custom signature for detecting non-SSL traffic on a specific SSL port (let's say tcp/443). This has to do with CONNECT tunnels through an HTTP proxy. Conceptually, it's not a complicated idea. Whether or not it can technically ...

Is it possible to correct incoming and outgoing packet's MTU size for example to 1200 ? on ONE virtual interface ... for example named as "testing" ...is it possible to correct MTU size of packets going to/from selected host ?

Greetings all,I need some help with the following scenario. Site A is 192.168.100.x network with all computer default gateway pointed to the inside of the PIX 515E (192.168.100.1). Site B is 192.168.101.x network with all computer points to the insid...

HiI need to allow nfs (IP x.x.x.x) to be mounted from my internal network to a server in the dmz (y.y.y.y). Could someone please help me with this.I've attached my config for reference.Thanks in advance for any helpDan

Hi!We have ASA5520 and we are considering implementing ssl/webvpn.I have a few questions about this. 1. what is the diffrence between Webvpn and ssl-vpn.2. Can you use Cisco Secure Desktop with ssl-vpn or only with Webvpn?3. Are there any limitations...

does anyone know if PIX can be configured to allow IP options to flow through it? Apparently, certain apps like Netmeeting sent out IP option 0x014 which is rsvp packet and gotten dropped because of the debug action in PIX. I am using version 6.3. th...

I am trying to design redudancy into my network and while fooling around with ideas on paper i came up with some questions. i have two internet routers with two different ISPs. They will be running Gateway load balancing protocol between them and eac...

Hi,Has anyone tried using NAC alongwith Auth-Proxy at the same time ? E.g. Same admission rule configured both for eapoudp and auth-proxy.The goal is1. Have all Users go through NAC. The downloaded ACL after NAC validation isdeny ip any xpermit ip an...

I found that the default http inspect policy causes web mail systems like Yahoo, Gmail, HotMail, etc... to be blocked. The problem was that the PIX just generated a general TCP Deny log entry instead of stating the inspect policy was triggered. In or...

Hi AllCurrently I have x.x.x.64 255.255.255.240 being handled by dmz2 on my pix.The pix has the following set:nat (dmz2) 0 x.x.x.64 255.255.255.240 0 0It also has:static (dmz2,outside) x.x.x.76 x.x.x.76 255.255.255.255 0 0My question is if the dmz is...