IDS Configuration

[c.cochin]

One packet which contains a worm and the traffic is a legitmate one , hence my Firewall allowed the packet.My IDS detected the maliciousy activity and it is alarmed. I want automatically there should an ACL has to be formed in my Firewall/Router. How this scenario practically configured by using event viewer/IDS Manager. Pls explain.

[awaheed]

Hi Cochin,

You can use the shunning feature to get this done

Configuring Blocking using IDM:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids9/idmiev/swchap3.htm#593299

Additionally, shunning can be configured on PIX aswell:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#1026366

hope this helps,

Regards,

Aamir

-=-=-