Network Security

I have a PIX-514 configured for SSH. I also have a 4210 IDS on the internal network. At one time I know the IDS would shun (using the firewall). I believe that if you do a show ssh sessions on the firewall you will always see the IDS as connected. I ...

What engine parameters would be acceptable to tune out false positives. I do understand that this is network specific, but was looking for other's averages. SERVICE.SMB (6255)? I'm thinking HitCount= ~25FLOOD.NET (UDP)? I'm thinking Rate=4900FLOOD.NE...

We have 2 4235 NIDS devices that are run by a Security Monitor VMS server. Up until version S128 we were able to upgrade both devices through the MC, however this function has stopped working. The subsequent updates (S129 thru S135) appear to have wo...

I am trying a new code, 12.3.11T2 on our routers and every night when traffic is low, the spoke router with the new code on it would lose it EIGRP adjacencies. All the other spoke that are running 12.3.6a run fine. And the only way to get the neighbo...

HiWhen I initial setup ids 4235 and installed IDS MC 1.2 completed.I want import the sensor into IDS MC,when I add sensor by select device>sensor and fill the blank request and select next,my browser stoped.When you open control panel>service:tomcat....

Our organization just acquired a second external ISP connection in an effort to improve our connection to the internet.I have one PIX 535 protecting my internal network.I would like to send all port 80 traffic out ISP connection #1 and everything els...

Hello, I have a PIX 501 that is configured as a DHCP server for some internal hosts consisting of Thin Clients (Neoware and Wyse) and PC's. For the last few weeks, the DHCP service has been acting up and refusing to assign addresses to the Thin Clien...

Hi Experts.Last saturday I attempted to replace an old Pix 520 OS 5.1(5) with 2 brand-new Pix 515E OS 6.3(3) in standard failover configuration.The Customer has many public servers on the inside and a few servers on the DMZ as well. Additionally, the...

If I suspect that my network is under attack, what level should I be logging, and what should I be looking for, to tell if someone is attempting to attack my network? Thanks.

Help! Trying to set up an InterTel IP phone, outside the host site which is protected by a PIX515E.The internal IP phone host is connected to the DMZ; for testing, I am permitting anything in to the DMZ (no other hosts).Everything is working except w...

I'm sort of in a weird situation. We swiched our ISP's because of poor service and got hooked up with 2 DSL lines with our new ISP. They said the PIX that I have can do two lines (2 default routes), I didn't think I could at the time because I only h...

Hello,does anybody knows exatcly what happen to a Pix URprimary unit if not connected any way (no lan or serial failover cable)to a secondary FO unit ?We where upgrading from a pix515 to a pix515e so we left the new pix515e-ur unit alone and we had s...

I wonder how many interfaces does my pix support.It says 3 in show version, but I dont know if it's 515-R or 515-UR (UR support 6 ifs)This is my show verCisco PIX Firewall Version 6.1(1) Compiled on Tue 11-Sep-01 07:45 by morleelatin3.fw up 14 hours ...

IDS and VMS are working fine, the issue is when my Windows box running VMS goes offline(crash, reboot....). I bring the VMS box back online and poll the IDS, but it reports no events.I tested it by running Nessus while the VMS box is offline, from th...