I checked the security (firewall) section, it seems pretty good. However I would suggest to show the 'differences' among products in a different color/highlight to facilitate faster and better comparisons. For example if I compare the ASA 5520 AIP-SSM-10 and AIP-SSM-20 models, the IPS throughput row should be represented differently than the other rows. Regards Farrukh ... View more

Please have a look at this link, it should help: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml Please rate this post if you find it helpful Regards Farrukh ... View more

Yes its the hit count since the last reboot or the hit count since the 'counters' for the access-list were last cleared (by using a CLI command) ... View more

If you work for a Cisco Partner you can access the IPS Express (CCSP) Online Course, its more than enough to get you started, I think its from Thomson NETG. I would also recommened the IPS CBT from 'CBT Nuggets', Jeremy does a great job in explaining and illustrating the various IPS concepts and technologies And of course, your best friend is the Cisco Website. Regards Farrukh ... View more

Btw, I faced a similar issue with Four IDSM-2 of one of our customers, they were not showing any events yesterday. Today I came and opened IME and the events started coming. I changed nothing for sure. You may have a look at Tools >> IME Console Window and see if you are getting any specific errors ... View more

Oh you mean that :) For signature updates you need the Cisco Services for IPS, please find more information on the following link: http://www.cisco.com/en/US/products/ps6076/serv_group_home.html You can find the Data Sheet,Q&A and a presentation on that link. Once you get the service contract to your CCO, MARS can connect direct to the Cisco website to upload the latest signature updates. (The IPS sensors need to be updated separately). Regards Farrukh ... View more

In the Devices >> Device List >> Sensor Name Under "Event Status", do you see "Connected" or "Not Connected"? Did you try to right click on the Sensor(s) and do: Starts >> Events Connection Please note health monitoring and most other features are only supported for Version 6.1.x and not the versions you mentioned. ... View more

Ankur, can you please let us know you IPS platform and software version? Regards Farrukh ... View more

I would use one ASA with the AIP-SSM module. And then place a seperate Anti-x type of device at the back. Having a seperate ASA for the CSM module is overkill IMHO. There is no real integration between the CSM/IPS module anyway, so you still have to manage different GUIs. A good option would be to go for IronPort, since they are now part of Cisco, there might be some neat integrations coming along in the future (giving you more value for money). There is'nt any great feedback about the CSM module, most people I know don't like to position it, including some Cisco CSEs themselves(its based on Trend Micro btw) Regards Farrukh ... View more

You post is a little cryptic, but I am assuming you are talking about the 'name' command in PIX/ASA/FWSM? We faced the same issues on our network, MARS was unabled to understand the name command referenced in our ACLs and it would show 0.0.0.0 instead of properly resolving the name to IP (from the firewall configuration). It also has similar issues with Netscreen Addresses (when defined as names). I hope this is on the feature roadmap. Regards Farrukh ... View more

Since the IPS dynamic update is accessed from the Admin tab, only the accounts having Admin privilege can change/modify the dynamic update settings, Here is a description of the various user roles in CS-MARS (taken directly from the user guide): . •Admin: has full use of the MARS. •Notification Only: for a non-user of the MARS appliance, use this to send alerts to people who are not administrators, security analysts, or operators. •Operator: has read-only privileges. •Security Analyst: has full use of the MARS, except cannot access the Admin tab Hope this helps ... View more

Hello Please try to ask your network management questions in the following forum (which is dedicated to Network Management): http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=Network%20Management&CommCmd=MB%3Fcmd%3Ddisplay_messages%26mode%3Dnew%26location%3D.ee71a02 You will have a better chance of a helpful response there. This area is for Cisco MARS. Regards Farrukh ... View more

Thanks once again for your prompt responses. As my colleague mentioned earlier: "Recently we have started evaluating the Ciscoworks LMS 3.0.1 Product to replace our existing NMS including BMC Visualis (fault management), which we finally decided to shutdown after numerous errors/database failures etc. " So the reason for shutting down BMC is already mentioned before. We are looking for a product that is reliable at fault management. I have seen heard numerous people shutting down HPOV for similar reasons so have my reservations about that too. I've just checked the polling value you mentioned, and it is set to the default (5 mins for Critical Devices). Also clicked on 'Show Devices' and verified four devices (two core switches and two access layer switches used for testing are part of 'Critical Polling'. Can you please let us know what else could go wrong here? Thanks Farrukh ... View more

Thanks once again for your prompt responses. As my colleague mentioned earlier: "Recently we have started evaluating the Ciscoworks LMS 3.0.1 Product to replace our existing NMS including BMC Visualis (fault management), which we finally decided to shutdown after numerous errors/database failures etc. " So the reason for shutting down BMC is already mentioned before. We are looking for a product that is reliable at fault management. I have seen heard numerous people shutting down HPOV for similar reasons so have my reservations about that too. I've just checked the polling value you mentioned, and it is set to the default (5 mins for Critical Devices). Also clicked on 'Show Devices' and verified four devices (two core switches and two access layer switches used for testing are part of 'Critical Polling'. Can you please let us know what else could go wrong here? Thanks Farrukh ... View more