If I understand your question, you'd like to know how the PIX firewall and the IDS sensor (either appliance, IDSM-2 or NM-CIDS) communicate with one another, particularly for "blocking" purposes.
IIRC, the sensor with use SSH (TCP port 22) to talk to a PIX in order to change ACLs in response to alarms being triggered that have been configured to "block".
With routers, these comms actually occur via TELNET (TCP port 23) instead, though I believe SSH can be used in place of TELNET.
I hope this helps,
Alex Arndt
