Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About melchib
Stats
Member since
04-24-2006
69
Posts
14
Helpful
1
Solution
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
02-11-2011
07:42 AM
02-11-2011
07:42 AM
Hi Fadi, Thanks for the response. In our design, the only time we would really see asymmetric traffic is if one of the 4270's link's went down. If we lose an entire 4270 we are still ok - just an individual link is when we could encounter asymmetric flows. I'd really like to design around that, but it seems the only way would to have a services block layer where via STP we can rely on the traffic always going to one switch. vPC with all it's benefits does lose you a predictable traffic path. Brad
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
02-10-2011
07:36 AM
02-10-2011
07:36 AM
Hello, I'm working on a IPS design in a fully redundant DC that is almost impossible to force symmetrical flows. My question is when using assymetric mode for TCP reassembly - what exactly is lost? Below is the list I've come up with so far: 1. TCP Normalization. (No big deal in my case because the ASA provides alot of this same functionality) 2. Anomaly Detection. With assymetric mode this should be set to Inactive. I'm also including a diagram that depicts my situation.
... View more
Labels:
11-15-2010
08:08 AM
I have seen this issue before as well - even with vlan's matching up on both sides of the link. (3750G to Nexus 7k - vPC). Was there ever a resolution or explanation? Brad
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-09-2009
12:04 PM
10-09-2009
12:04 PM
Thanks Marcoa - Great Info, Very much appreciated. Cisco should have engineers write the release notes instead of the wonderful folks in marketing. Thanks again, Brad
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-09-2009
07:29 AM
10-09-2009
07:29 AM
Hi, I only have the chart for Standard mode - which I cannot find anywhere on Cisco's website - at least the guy presenting at Networkers was kind enough to put it in his prezo. However, in that same prezo he mentions (when there is a negative reputation for the attacker) Aggressive Mode will Deny Packet Inline when RR reaches 83 and Deny Attacker Inline when RR reaches 95. I'll include the slides
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-08-2009
02:30 PM
10-08-2009
02:30 PM
Hi, Whomever you purchased the ASA/IPS product from will have your SmartNet information. You will have Contract numbers they can provide you that you will tie to your CCO account. At that point you will get further access on CCO (mainly downloads) and be able to use your account for the automatic sig updates.
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-08-2009
02:21 PM
10-08-2009
02:21 PM
I'd recommend trying it via the CLI -- http://www.cisco.com/en/US/partner/docs/security/ips/6.2/configuration/guide/cli/cli_system_images.html#wp1088688 If that doesn't work, as a last resort you could backup your config & re-image the sensor with the new code. Then copy/paste your config back on - just make sure you paste it section by section. I've had to do this with stingy sensors in the past as well... http://www.cisco.com/en/US/partner/docs/security/ips/6.2/configuration/guide/cli/cli_system_images.html#wp1230355
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-08-2009
01:33 PM
10-08-2009
01:33 PM
Hi, I'm currently working on Tuning a pair of IPS modules in ASA's. We are currently in Promiscous and tuning/filtering to ensure we don't block any valid traffic when making the switch to inline. We are using the new 7.0.1 code and getting the global correlation / reputation data - works great & rocks. When viewing the events - there is a paramater - "Global Correlation Risk Delta" -- Could someone explain to me what that is? I understand how it adjusts the RR based on reputation & have the chart (including it for those who do not have it - got it from a networkers prezo). However I am having a hard time figuring out what Global Correlation Risk Delta is/means/does...anyone know? Thanks, Brad
... View more
Labels:
07-06-2009
01:25 PM
Hello, I'm working on an ASA that is at 8.0(4)32 and ASDM 6.1(5)57. Below are the logging statements I have in the config: logging enable logging timestamp logging standby logging buffer-size 32000 logging buffered informational logging trap debugging logging asdm debugging When I am troubleshooting I will see messages using the command "show log" that I will not ever see in the ASDM when using the Real Time Log Viewer. Is there something I'm missing in the config?
... View more
Labels:
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
06-12-2009
05:37 AM
06-12-2009
05:37 AM
Wow - I had no idea it would drop traffic if it went over the inspection theshhold...errrr...Do the ASA IPS modules behave this way as well? Thanks again - this has been a huge help. Brad
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
06-11-2009
02:40 PM
06-11-2009
02:40 PM
Thanks Marcoa, If traffic is asymmetric - and either the IPS1 or IPS2 cannot see the entire flow - then I'm guessing this design will not work or will be ineffective? Also - if traffic would spike, the IPS will just fail it open (if configured) and just not inspect that traffic correct? Thanks again, Brad
... View more
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
06-11-2009
09:22 AM
06-11-2009
09:22 AM
Hi, I'm trying to determine if you can have a 2-gig Layer-3 Port-channel going thru an IPS 4260 appliance. See attached diagram. Is this possible? The client I'm working with would prefer not to break this Port-channel into equal-cost 1-gig links (I don't think there will be any performance difference...) However I'm thinking if they want the appliance inline like the diagram shows - they will need to break the port-channel. Is that a correct assumption? Thanks, Brad
... View more
Labels:
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
03-16-2009
05:24 AM
03-16-2009
05:24 AM
Does IPS Manager Express build it's reports from the data on the Sensor's you are managing -- or the data it has downloaded from the sensors over a period of time? I'm trying to figure out if IPS Manager Express keeps data on the box or always just grabs it from the Sensors & doesn't actually store it. Thanks, Brad
... View more
Labels:
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
03-16-2009
05:23 AM
03-16-2009
05:23 AM
Hi, I'm just curious what happens to traffic when you have an IPS module in an ASA and it reaches the maximum throughput? Does it allow the traffic & only inspects what it can handle? Or does it "fail" and then either allows all the traffic or block based on "fail-open" or "fail-close" configuration? Thanks, Brad
... View more
Labels:
03-09-2009
10:01 AM
vmoopeung -- Your response would suggest that you didn't even read my question. Thanks for the copy/paste from the data sheet.
... View more
10-23-2019
Thanks for the reply Andrea. The default hardware rate-limiter looks
like its much more aggressive t...
10-18-2019
SWITCH# show mod Mod Ports Module-Type Model Status --- -----
------------------------------------- ...
10-17-2019
Hello- Just curious if anyone has used "hardware ip glean throttle"
command on the Nexus 9K platform...
Created by
melchib
in Data Center Switches
10-17-2019
10-17-2019
Border Gateways are used for L2 extension or extending your fabric to
another fabric. Doesn't seem t...
Created by
melchib
in Data Center Switches
10-17-2019
10-17-2019
I'd heavily advise against this. You should keep the spines as simple as
possible. If you try and co...
Created by
melchib
in Data Center Switches
06-11-2019
06-11-2019
Those other host routes you need advertised - either permit them via
prefix-list in route-map ahead ...
Created by
melchib
in Data Center Switches
06-11-2019
06-11-2019
Did you also remember to configure system nve infra-vlans
force for the vlan you are using for the ...
02-11-2011
Hi Fadi, Thanks for the response. In our design, the only time we would
really see asymmetric traffi...
02-10-2011
Hello, I'm working on a IPS design in a fully redundant DC that is
almost impossible to force symmet...
11-15-2010
I have seen this issue before as well - even with vlan's matching up on
both sides of the link. (375...
Created by
melchib
in Data Center Switches
06-04-2010
06-04-2010
Thanks Abhinav - We were able to update the displayed version per your
directions.Brad
Created by
melchib
in Data Center Switches
06-03-2010
06-03-2010
After an upgrade of the 1000v from SV1.2 to SV1.3 - the version does not
update when viewing the 100...
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-09-2009
10-09-2009
Thanks Marcoa - Great Info, Very much appreciated. Cisco should have
engineers write the release not...
Created by
melchib
in Intrusion Prevention and Detection Systems (IPS - IDS)
10-09-2009
10-09-2009
Hi, I only have the chart for Standard mode - which I cannot find
anywhere on Cisco's website - at l...
Public Statistics
| Date Registered | 04-24-2006 09:08 AM |
| Date Last Visited | 11-05-2019 11:15 PM |
| Total Messages Posted | 69 |
| Total Helpful Votes Received | 14 |
