blocking facebook in IDSM-2

[Shaikh Aman Uddin]

Hi,

I hv IDSM-2 installed in promiscuous mode in 6509 Switch, it is triggering signatures and working perfeclty. But when I use the internet using my Bluecoat proxy server (proxy server ip address in client's PC)  for internet website (like:www.facebook.com), it is unable to block this site. Since it is blocking the facebook website without Bluecoat Proxy Server fine. Kindly add your valuable suggestion/solution.

I collected few captures from Client PC, IDSM (all interfaces, including Dataport & System interfaces) are attached.

Aman

[rhermes]

Are you TRYING to block facebook with your IDSM?

Do you have shunning configured on your IDSM? If you do what is the IDSM shunning to? A Cisco router or the host 6500/7600?

A promisicous mode sensor without shunning should be be able to block anything.

- Bob

[Shaikh Aman Uddin]

Hi Bob,

Acutally, shunning is not confirgured on IPS, since I want to stop only specific type of traffic (facebook), if I do config shunning then it will block all http type of traffic.

Without Bluecoat proxy server, IDSM-2 is blocking perfectly.

Kindly advise

Aman