A couple of things to be aware of.
When the shun command is issued on the Pix the syntax has the source address, destination address, source port and destination port.
Some people have mistaken this to mean that only that single connection is shunned by the Pix, but in fact the Pix will shun the entire Source Address.
It uses the rest of the information to internally close down that specific connection instead of having to way for a timeout to close it down. The additional information, therefore, is not manadatory it just helps clean up the internal connection list kept in the Pix memory.
So in this case, once the sensor is able to reconfigure the Pix no more connections should be allowed through from the source address. If after the Pix is reconfigured the connections are still coming through, you should contact the TAC and ask for assistance from the Pix team, as this could be a bug on the Pix.
Something to be aware of is the fact that the Pix will only be able to block new connections AFTER the sensor has reconfigured it. This reconfiguration by the sensor can take a few seconds depending on the number of shuns taking place and the number of network devices being managed by the sensor, during which time additional connections from the source address may have already come through. This may be what you are seeing.
We are conitnually trying to improve the sensor and shunning performance, but there will always be a slight delay from the time the alarm is detected to the time we can change the network device configuration.
Currently there is also a limit to the total number of shuns that can be applied to a network device. We will be raising this upper limit in a future version, but users need to be aware that the more addresses being shunned the longer it takes to apply new shuns to the network devices.
We are working on ways to apply the shuns faster on the network devices, but we are somewhat limited by the commands supported on the network devices themselves, and the speed at which they respond to our reconfiguration requests. (i.e. it takes longer to apply a shun on a Pix Firewall that is heavily utilized because it takes the Pix longer to respond to our configuration changes)
