Showing results for 
Search instead for 
Did you mean: 

Core issue

The Cisco Intrusion Detection System (IDS) functionality on the PIX Firewall is only available in PIX Operating System (OS) version 6.0 and later. However, some signatures supported in the Cisco IDS Sensor are not available in the PIX.


The PIX lists these single-packet IDS signature messages:

  • 1000-1006      
  • 1100      
  • 1102      
  • 1103      
  • 2000-2012      
  • 2150      
  • 2151      
  • 2154      
  • 3040-3042      
  • 4050-4052      
  • 6050-6053      
  • 6100-6103      
  • 6150-6155      
  • 6175      
  • 6180      
  • 6190

The PIX lists single packet (atomic) Cisco IDS signature messages through the System Log (Syslog). All PIX IDS Syslog messages start with %PIX-4-4000nn (where nn is in the range of 00 through 51) and have this format:

%PIX-4-4000nn IDS:number string from IP_address to IP_address on interface interface_name

These descriptions define the format:

  • The number is the signature number.  
  • The string is the signature message, and is approximately the same as the NetRanger signature message.  
  • The IP_address is the local to remote address to which the signature applies.  
  • The interface_name is the name of the interface where the signature originated.

For example:

%PIX-4-400013 IDS:2003 ICMP redirect from to on interface dmz

This means that the IDS log message 400013 is for the signature "ICMP redirect", whose signature ID is 2003.

For more information on the PIX IDS Syslog messages and the commands used by the PIX to handle the signatures, refer to the Managing IDS Syslog Messages of Accessing and Monitoring PIX Firewall.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers
Quick Links