Network Security

New IDSM2 installation here. Just got them to work last week so no real tuning done yet. They are running in promiscuous mode with software version 5.0(5sp2). We are using CN-MARS 4.1 to collect events.I'm seeing a lot of RPC DCOM overflow events ...

Tried CISCO IDS sensor 4250-XL with the following 4 interfaces: Int0- ethernetInt1- ethernet -- command and control interfaceInt2- fiber Int3- fiber Can we use Int0 (ethernet) interface as the sensoring interface? Whenever I tried to add it to sensor...

I have a strange problem on an ips mc / secmon 2.2 solution. When I open the security monitor from a specific time and date, the console shows events that have occurred prior to the date that I requested. Before experiencing this problem, I manually ...

I have a Pix 525 with multiple DMZ's. Behind one of the DMZ's lies my public interface of a traffic mitigation server. Fron this interface the server sends out TCP resets for P2P traffic to save upstream bandwidth. I am seeing that the pix is prev...

Hi All!I would like to know a little more about the "Generic Authorization Message Exchange" Protocol (GAME) used between ACS and audit Server.Is there any documentation ? .. other source of info?I also have another question:is there any Cisco Book a...

Hi,I don't have any experience in selecting or implementing a host based intrusion detection package.I need a package to sit on a web server (Win 2k / 2003 with IIS), running some e-Commerce websites, and I need to make sure that this package can det...

Does any one know the syntax to export events with idsalarms.exe from specific date in VMS2.1?

hiI want opinions and suggestions if below scenario works for inline placement of IPS 4240. Or need to do differently.[vlan A on cat6509 IP 10.0.0.1 (all outgoing traffic is routed to 10.0.0.2-pix) ] + one port of inline pair port of IPS ==> VLAN B ...

I recently upgraded a PIX from 6.3(3) to 6.3(5) for a client a couple of Fridays ago. Their network is flat, and consists of Win2K, WinXP, and MACs (running AppleTalk and IP). They have a single internal L2 3Com switch. The configuration is straightf...

Dear All,I would like to block a single IP in the LAN (inside network )to access to the Internet. The following is the configurationaccess-list inside_access_in deny tcp host 192.168.1.247 anyaccess-list inside_access_in permit tcp any anyaccess-grou...

We are configuring an IDS 4215 and a Pix 501. We can manually add a block in the IDS which updates the Pix, but no matter what setting on a signature is made the IDS will not automatically add the block to the pix when the signture is detected. Thank...

I don't understand why this is firing. It looks like it should only fire if there is a non-numeric value for the query parameter graph_start...which there isn't. Here are the details.Arg Name Regex: [Gg][Rr][Aa][Pp][Hh][_][Ss][Tt][Aa][Rr][Tt][=]Arg V...

hiI am not able to successfully start gui admin console on my MS IE browser 6.0.2. It gives me error that "Your browser does not have the required Java Plug-in. IDM requires Java Plug-in version 1.4.2 or higher. You can download the Plug-in from http...

Hi, I have a 2811 with 2 interfaces. 1 that is my T1 to the Internet and 1 that connects to my LAN. On the WAN interface, I have IPS turned on for in and out. However, when I have it turned on for the in, traffic on the inside has about 30% succes...