Network Security

Hello,I've just recently been faced with a flood on a 3750 that I can't seem to handle and would greatly appreciate any help offered.I have the following setup:24 interface used out of 48 on a Cisco 3750.The C3750 has unicast storm control which prev...

I would like to configure a 5.x sensor to sync to ntpd running on Linux, specifially Redhat. Anybody have any experience doing this? Thanks,Matt

Right now I am planning a new network and i haven't decided if i should use the fw features in the 2800 router or use the pix 515s i have right now. keep in mind that i have a cluster of ISA servers on my network . is the FW features in teh 2800 much...

I understand the use of the ? character in a regex to match on 0 or 1 occurances of the previous character. But, I don't understand what it means when it is in braces. Some examples:Sig 3200 RegEx ends with [? \r\n\t], it appears that there is a spac...

I have encountered an issue with a CheckPoint SecureRemote VPN client running through a PIX-515e firewall. The client appears to connect, and traffic seems to be getting to the CheckPoint firewall, but the client does not receive any responses. The C...

The "Bad Layer 4 Checksum" counter for our IDSM2 (inside 6513) has a very large value. Does anyone have a link/information on this counter ?Thanks,David

I have been unable to import a VPN 3000 Concentrator into VMS Management Center for VPN Routers. When importing the device it requests an enable password for the VPN. I would assume that this parameter is ignored if the VPN does not have an enable pa...

Can the CSA management console be installed on Windows Server 2003?

Hi!As I wrote in my previous post: "TCP Reset feature" I would like to reset a P2P connection using the TCP Reset action of Cisco IDS. I cannot block the IP (shun connection) since it could represent a NAT address.Anyone has solved the same problem?I...

Hello,We've got two PIX'es setup in failover mode, we had an issue a day or so ago when the secondary pix took over the IDS was dead in the water because the SPAN config on our 6500 is not duplicating both ports. Suggestions on getting the SPAN confi...

Hello,We recently installed our IDSMs and a MARS box to monitor our core traffic. I'm trying to set up a MARS "User Inspection Rule" to notify me when there is FTP traffic on a port other than port 21. Is there an easy way to do this? I don't see any...

Greetings all. It doesn't appear that the recent S195 signatures are listed/referenced in the Secure Encyclopedia.Can Cisco confirm this? If not, when can we expect them to be listed? Thank you.

Please advise what are the requirements to allow VMS MC 2.0 to support both versions of IDS signatures. We have a few devices on IDS-sig-4.1-5-S196 and some on IPS-K9-sp-5.0-4. TIA,Simone.

Hello All,We have set up a IDSM2 version 4.1 on a Cisco Catalyst 6500 switch.We have configured it using SPAN on specific vlans and if we run a port sweep, we can see the alarms on the IDS viewer.It is possible to stop any attack by dropping packets/...