pix alarm

[mbhat]

I would like to know the use of these commands on pix:

ip audit info action alarm

ip audit attack action alarm

What does the key word `Alarm` signify in both these statements, what is the effect of the `alarm option` when a security breach occurs ?

Regards,

Mahe

[mike-greene]

Hi, these lines are for the IDS feature in the PIX. The "ip audit attack" command specifies the default actions to be taken for attack signatures. The "ip audit info" command specifies the default action to be taken for signatures classified as informational signatures. The "alarm" option indicates that when a signature match is detected, the PIX reports the event to the configured syslog servers.

Hope that helps.....