Network Security

I have problem with configuring the alarms on IDS 4.1 when ACL violation syslog message is received. I have simple config on the router:access-list 120 deny ip any host 10.10.17.254 logaccess-list 120 permit ip any anyinterface Ethernet0/0 ip address...

Wondering if CSA agent for Linux is available yet? If yes, In our scenario we have two web sersers are in DMZ segment and once one is active and other is passive mode and is waiting for failover, question is do I need separate csa agent for active an...

Does CSA server agent supports HP-UX and ORAcle applications?if not, any possibilities?

My company is trying to extend our network to remote offices in the US and abroad. I have seen several examples of configurations for single site to site tunnel termination, but never any for several remote tunnels back to one PIX. I would use the re...

I have a PIX-514 configured for SSH. I also have a 4210 IDS on the internal network. At one time I know the IDS would shun (using the firewall). I believe that if you do a show ssh sessions on the firewall you will always see the IDS as connected. I ...

What engine parameters would be acceptable to tune out false positives. I do understand that this is network specific, but was looking for other's averages. SERVICE.SMB (6255)? I'm thinking HitCount= ~25FLOOD.NET (UDP)? I'm thinking Rate=4900FLOOD.NE...

We have 2 4235 NIDS devices that are run by a Security Monitor VMS server. Up until version S128 we were able to upgrade both devices through the MC, however this function has stopped working. The subsequent updates (S129 thru S135) appear to have wo...

I am trying a new code, 12.3.11T2 on our routers and every night when traffic is low, the spoke router with the new code on it would lose it EIGRP adjacencies. All the other spoke that are running 12.3.6a run fine. And the only way to get the neighbo...

HiWhen I initial setup ids 4235 and installed IDS MC 1.2 completed.I want import the sensor into IDS MC,when I add sensor by select device>sensor and fill the blank request and select next,my browser stoped.When you open control panel>service:tomcat....

Our organization just acquired a second external ISP connection in an effort to improve our connection to the internet.I have one PIX 535 protecting my internal network.I would like to send all port 80 traffic out ISP connection #1 and everything els...

Hello, I have a PIX 501 that is configured as a DHCP server for some internal hosts consisting of Thin Clients (Neoware and Wyse) and PC's. For the last few weeks, the DHCP service has been acting up and refusing to assign addresses to the Thin Clien...

Hi Experts.Last saturday I attempted to replace an old Pix 520 OS 5.1(5) with 2 brand-new Pix 515E OS 6.3(3) in standard failover configuration.The Customer has many public servers on the inside and a few servers on the DMZ as well. Additionally, the...

If I suspect that my network is under attack, what level should I be logging, and what should I be looking for, to tell if someone is attempting to attack my network? Thanks.