IDS 4210 v3.1
PIX 515UR v6.2(2)
Cisco host IDS v2.5
I've configured the IDS to issue shun commands to the PIX. Manual blocking works ok. I also see the IDS issue blocking on it's own during an attack. I can verify this in the PIX.
However, I also see the Cisco host IDS on the target of the attack (web server on DMZ), log and prevent the attack.
That tells me that the IDS/PIX is not stopping all the packets. Right?
My question is: When the IDS detects an attack, should ALL packets be stopped or will the first one/few get through?
Tony
