Double Detected Signatures

[community]

I have an internel and an external sensor. Both sensors are picking up Netsky virus activity from the same external address. My outside sensor is setup to shun those addresses. Should't that prevent any signatures from passing through the firewall?

[darin.marais]

This thread should help;

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.eeae06e/0#selected_message

[mcvosi]

You can opt to block the offending source IP address completely.

I tend to do this when I see obscene amounts of virus-related traffic from one particular source, over all other infected sources. And when the admin of that network complains about not being able to e-mail us, I suggest to he/she that they should pay closer attention to what occurs on their network.