PIX 'shun' command

[m.mohanasundaram]

Hello Guys,

This command is not working as expected.I configured;

pix(config)# shun 172.16.5.100 144.10.55.1 0 23 tcp

Shun 172.16.5.100 successful

pix(config)#

This command blocks all traffic from 172.16.5.100 to "all" destinations. My understanding is that it should only block traffic from 17.16.5.100 to 144.10.55.1 destined for telnet port, 23. But it blocks all traffic originated from 172.16.5.100, including ICMP.

Any thoughts?

TIA,

Mohan

[alexr]

Hello Mohan,

As far as i remember from PIX documentation shun command blocking all traffic originated from IP.

So all the rest of command is ignored.

The PIX shun command always shuns the source address regardless of whether or not the additional connection information is provided.

I think in this case better to use access-list statements.

Alex

[a.alekseev]

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801cd841.html#wp1026366