Network Security

HiI have been given the task of redeploying CSA after the CSA MC machine died (no backups or anything).Two things really.Firstly the agents are still deployed on the client machines. If I build a new CSA MC machine is there a way of getting our confi...

I have an IPS v5 running on my network and now on the process of tuning signatures. Event filter is one of the option that I am working now but it seems that it does not work. I want some of the signatures on my sensor to only trigger on my specified...

Question on VMS 2.3 in the SEC MON(sensor is a IDSM2) events I have notice that on one of my sensors the following Alert Detail: Traffic Source int0(other details show int7 as my source):, is this the TCPRESET port? if so I do not have that SIG set t...

I have a 4215 that I have setup inline. In addition, I have given it the ability to use a PIX to block hosts. When the sensor tries to login to the PIX, it triggers the "multiple rapid ssh connections" signature and adds the sensors IP address to the...

Hi, We recently set up a PIX (with Passive FTP mode enabled) which allow1) Outgoing from Internal to External for http,https, dns,ftp, smtp2) Incoming from External to Internal forsmtp, ftp , dns and POP3. We host a mail serverand ftp server for publ...

Hi,We hv a PIX 515E- firewall setup in active/failover mode.Pls refer attached diagram.We hv to use the proxy server which is placed in DMZ as gateway for Inside users browsing.In other words all the internal users will be pointing to the DMZ proxy s...

I have Security Monitor 2.1.0 (Build 123) in a CW VMS 2.3. It collect events from some IOS IPS. The IOS IPS have the correct time. The events generated in the device has the correct time (I can see it with "show log" command). In the device, with "sh...

Our company use a product called Scansafe for web scanning. Every now and then we are sent a report from scansafe along the lines of:"The ScanSafe service discovered a possible virus or malicious code in a Web page or download accessed from within yo...

The 'idsmdc.log' & 'idsmdc.db' file under %NMSROOT%\MDC\Sybase\IDS folder has grown to 10GB & 6 GB respectively. I'm using VMS2.2 on Win2K Machine. What are these files, and how do I prune these files? Is there a perl script available to prune these ...

Hi! I'm wondering if there is the possibility of excluding an IP address from the RESET, even if the rule is matched. Thanks in advanceFrancesco

I am trying to connect to a On-line Game through PIX. But the connection is never successful. After I bypass the PIX, and connect to the Game Server. The connection is OK, and I can play the game. The PIX OS is 7.0.2. And I have uploaded two Sniffer ...

I have a classic EZVPN setup with a VPN3020 as the server and about 20 or so 831 clients. My problem is that you can't issue the qos pre-classify command under an EZVPN profile. In this case how would I prioritize traffic witin the EZVPN tunnel?

i know pix 6.3 support vlan,support 802.1q,i wonder if pix support routing between vlan?