FWSM and shunning?

[admin_2]

Can an IDS management station send shunning configurations to the FWSM?

[scoclayton]

Yup, though to be more correct, the shun commands are coming from the IDS sensor itself rather than the IDS Management Station. The sensor opens a telnet/SSH session to the FWSM and issues the commands as needed. Hope this helps.

Scott

[dbobeldyk]

Did you try this Scott? Do you know for sure that it works?

I'm receiving an error in my IDS event log that the version of the FWSM is not supported (1.1 & 2.2, I tried both)

Any suggestions? Thanks in advance.

[scoclayton]

I am guessing you are seeing something like this:

evError: eventId=1088050941971244051 severity=error

originator:

hostId: IDSM-

appName: nac

appInstanceId: 27739

time: 2004/06/30 03:09:34 2004/06/30 03:09:34 UTC

errorMessage: name=errSystemError Device [PIX] IP [] Version [2.2] not supported.

If so, this error message can be ignored. The reason it is printed is because version 4.0 sensors expect the version of PIX to be greater than 6.0. In the case of a FWSM, this message can be ignored. Version 5.0 of the IDS code will officially support FWSM code.

But yes, I have seen shuns to the FWSM work. Issue a 'sh shun' on the FWSm after an alarm has triggered a shun and you should see it listed.

Hope this helps.

Scott