Shunning server

[tednie]

What files and entries need to be configured for a sensor to forward shunning requests to another sensor? Thanks in advanced.

[ciscomoderator]

Often times complex configuration issues are best addressed in an interactive session with one of our trained technical assistance engineers. While other forum users may be able to help, it’s often difficult to do so for this type of issue.

To utilize the resources at our Technical Assistance Center, please visit http://www.cisco.com/tac and to open a case with one of our TAC engineers, visit http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.

[stleary]

Try this link (for IDS 3.0):

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/12216_02.htm#xtocid1115836

[tednie]

All I found was:

If you are using the UNIX Director, you must also make some other settings. The appropriate auths, routes, and hosts files have to be updated on both the client and server Sensors in order to support IDS communications. See the IDS management documentation at the following websites to configure shun servers and clients:

I then followed the link to the user guide, and there was nothing referencing the necessary file adjustments needed for shunning server and client.

Thanks

Tom

[jlively]

Using the director, modify the hosts and routes and auths files on the 2 sensors (both the client and the server). Then set up the server/client, the sensors will be selectable as options.