10-29-2004 04:52 AM - edited 02-20-2020 11:42 PM
Just installed a new IDS, Have enabled several default sig. Have telnet configured to PIX. Have verified using (who) in pix and it shows the IDS. Problem: IDS is not sending any SHUN statements to PIX. Is there anything in the PIX I need to set to allow the SHUN to work? Not sure what to look for next. Need suggestions Please??
Thanks
10-29-2004 06:14 AM
Have you made sure an alarm is firing and sending a block request to nac (network access controller)? Do a show events from the sensor cli. When the alarm fires there should also be an event requesting a shun(block).
When you enabled the sigs, what event action did you set, block connection or block host ?
10-29-2004 10:23 AM
Looked in events, it shows no event requesting a shun?
I enabled sigs by default, selecting the (attack) option. Cant seem to find the event action to block connection or block host?
IDS 4.1 PIX 6.3(4)
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide