Network Security

I understand the use of the ? character in a regex to match on 0 or 1 occurances of the previous character. But, I don't understand what it means when it is in braces. Some examples:Sig 3200 RegEx ends with [? \r\n\t], it appears that there is a spac...

I have encountered an issue with a CheckPoint SecureRemote VPN client running through a PIX-515e firewall. The client appears to connect, and traffic seems to be getting to the CheckPoint firewall, but the client does not receive any responses. The C...

The "Bad Layer 4 Checksum" counter for our IDSM2 (inside 6513) has a very large value. Does anyone have a link/information on this counter ?Thanks,David

I have been unable to import a VPN 3000 Concentrator into VMS Management Center for VPN Routers. When importing the device it requests an enable password for the VPN. I would assume that this parameter is ignored if the VPN does not have an enable pa...

Can the CSA management console be installed on Windows Server 2003?

Hi!As I wrote in my previous post: "TCP Reset feature" I would like to reset a P2P connection using the TCP Reset action of Cisco IDS. I cannot block the IP (shun connection) since it could represent a NAT address.Anyone has solved the same problem?I...

Hello,We've got two PIX'es setup in failover mode, we had an issue a day or so ago when the secondary pix took over the IDS was dead in the water because the SPAN config on our 6500 is not duplicating both ports. Suggestions on getting the SPAN confi...

Hello,We recently installed our IDSMs and a MARS box to monitor our core traffic. I'm trying to set up a MARS "User Inspection Rule" to notify me when there is FTP traffic on a port other than port 21. Is there an easy way to do this? I don't see any...

Greetings all. It doesn't appear that the recent S195 signatures are listed/referenced in the Secure Encyclopedia.Can Cisco confirm this? If not, when can we expect them to be listed? Thank you.

Please advise what are the requirements to allow VMS MC 2.0 to support both versions of IDS signatures. We have a few devices on IDS-sig-4.1-5-S196 and some on IPS-K9-sp-5.0-4. TIA,Simone.

Hello All,We have set up a IDSM2 version 4.1 on a Cisco Catalyst 6500 switch.We have configured it using SPAN on specific vlans and if we run a port sweep, we can see the alarms on the IDS viewer.It is possible to stop any attack by dropping packets/...

Hi!I would like to realize the reset of a single TCP connection (Ip adress + port number) using a CISCO IDS 4235,Version 4.1(5)S194, with a PIX 520, IOS Version 6.3(3) and a 4500 router, IOS Version 12.0(8b).Is it really possible by this hardware?I t...

We want to change these to ports to another number in our PIX 515E. We are using it for incoming and outgoing email. Can someone help in what we would change? Thanks soo much!!!

I have configured two IPIP VPN tunnels from the main office to the branch offices. I would like to apply QOS for specific traffic and when I go in to the Tunnel interface to apply the QOS Pre-classify command I couldn't find it.I am aware that this c...

Dear All,I want to give the whole lower security network 10.10.10.0/25 access to the internal higher security network 192.168.100.0/24.without using NATWhat is the pix cmds in ver.6.3 to be used?In one-to-one Translation we can use static (inside, dm...