When you create an object-group with the tcp-udp at the end and you list services like 80 or 25 which on use tcp how does the PIX/object-group know which protocol to associate the traffic with?
hi..i'm using idsm2 & vms ver2.2 (includng idsmc & security monitor)i've tried to make a test on network reconnaisance attack using NMAPWin tools. When i run that tools to scan open ports, 3 signature detected :1. TCP Null packet2. TCP SYN/FIN Packet...
Hey guys:I was just wondering your thoughts on filtering out email virus alerts that are going to a spam/virus filter. They aren't getting past the filter, so i'm not sure the value of having them alert. Any thoughts?
Hi everybody,anyone of you knows the meaning of this message:"Sensor update for <sensor name> failed.The current version 4.1(4)S106 did not match the applied version 4.1(4)S113 after update." Source application: Shared service processes Subsystem: Co...
I am trying to open port 21 on router 831 for accessing FTP server. I added the fllowing two lines. access-list 10 permit 171.16.5.2ip port-map ftp port 21 list 10But can telnet it. When double-checking the configuration, I don't have "ip port-map ft...
I'm attempting to upgrade the IOS image on a 1710 router connected via VPN tunnel to a 3000 concentrator; it routes all inside traffic to the tunnel, but since the 1710 attempts to communicate itself from the outside interface, it cannot see the TFTP...
Hi all,i've to upgrade signature on my IDS MC server. I have to put .zip signature on \etc\ids\updates folder only or i've to do something else??Thanks you Marco
I'm new with the product and am a bit confused over the password scheme. Within the 3005 Concentrator admin I can assign passwords to both groups and individual users. I'm reading a book from Cisco Press on the concentrator and it seems to suggest,...
Hi all,is there a way to set an IDS4215 to block offendig host (via ACL on a Cisco router) at every Signature with Severity High?Or must I change the properties of every single signature?ThanksStefano
Sep 7 16:58:01 sp %PIX-4-405104: H225 message CONNECT received from 55.xx.xx.xx/1720 to 132.x.x.x/5555 before SETUPSep 7 16:58:11 sp %PIX-4-405104: H225 message ALERTING received from x.x.x.x/1720 to x.x.x.x/5555 before SETUP
I have an IDS 4210 which controls a 2610 Router with two serial interfaces. I have a pre and a post access list for each. With no access-list applied to either interface I enable blocking and the access-list are created on each interface. All is well...
I have experimented with automated blocking, using an IDSM-2 to control ACLs on my edge 7200's. The issues I had were with the very low limits on manual blocking and manual whitelists. Also my preblock and postblock ACLs are 1000 lines long in tota...
NAT 0 for a interface vlan doesn't work, but for a interface without tag works.From Firewall console I'm able to access all computers in different vlan, this proves that there isn't no L2 problem... Have some experienced this situation?---------- ///...
