cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
603
Views
0
Helpful
1
Replies

IDSM and blocking

z.kypry
Level 1
Level 1

I update my IDSM to version 3.0(2) S6 and add it into CSPM v2.3.3i with S11. But when I try to block host I obtain the message

The status of blocking IP address 192.168.65.40 for 1440 minutes on host "m3c-ids" is:

Error: The command failed

The IDSM has IP address 192.168.64.10

cat6506-msfc#sh users

Line User Host(s) Idle Location

1 vty 0 idle 00:00:16 192.168.64.10

* 2 vty 1 kypry idle 00:00:00 127.0.0.11

Interface User Mode Idle Peer Address

cat6506-msfc#sh access-lists

Extended IP access list IDS_vlan65_in_0

permit ip any any (71290 matches)

cat6506-msfc#

Why the command is failed and IDSM doesn't change the acl to block a host?

What is wrong in my configuration?

1 Reply 1

stleary
Cisco Employee
Cisco Employee

The problem might be in the IDSM shunning configuration.

Check to see if you have set 192.168.65.40 as a never shun address?

Or have you configured a never shun network that includes this address?