Great Document ! Extremely useful. ... View more

This is normal. Thats how it look by default on IDM for all IPS's. Sid Chandrachud TAC Security Solutions. ... View more

Can you upload a screenshot ? - Sid ... View more

Hello, Signature will not be compleletely effective in blocking Skype traffic. Signature 11251-0 only blocks exchanges with the host skype.com in the packets. The only time this occurs is when the version is checked and not during the actual phone calls. This is usually done when the client is started. Again, this means that Skype traffic is not what fires this signature. It is the client connecting to Skype to sync its version. Skype uses an aggressive adaptive networking application that is designed to reach the Internet. Skype sessions use an asymmetric key exchange to distribute the 256 bit symmetric key employed by the AES cipher for session encryption. Skype's initial outbound connection can use any dynamic combination of TCP and UDP ports, including outbound ports 80 and 443, which are generally open for HTTP and HTTPS access. This renders traditional port blocking filters completely ineffective. In addition, Skype uses proprietary methods of NAT traversal similar to STUN (Simple Traversal of UDP through NAT), ICE (Interactive Connectivity Establishment) and TURN (Traversal Using Relay NAT) to ensure that you can reach the Internet and to determine the client's eligibility to be a super node. Because Skype uses a proprietary, encrypted protocol, specifically designed to avoid detection and penetrate NAT, Firewalls and other network instrumentations there is no formal method for any DPI technology to perform compliant inspection of Skype traffic flows. However there has been a bug filed on this and the development team is working on it. Bug: CSCsh60496 http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsh60496 Sid Chandrachud TAC security solutions ... View more

Syslog uses UDP. SDEE uses TCP.  Use IME for Mars for event retrieval of IPS. Otherwise, you can use a SDEE server.  Please check my document for further information: https://supportforums.cisco.com/docs/DOC-12515   - Sid ... View more

Can you please close this thread and rate it if useful? - Sid ... View more

Hi Radim, Oversubscription in IPS is at Interface level or Virtual Sensor level. Hypothetically say IPS has 6 interfaces each being a gig port. This does not mean IPS throughput is 6 gigs, since the inspection engine may not be able to handle 6 gig at a time. For interface level oversubscription, if you send more traffic to an interface than it can handle, then you overwhelm its interface buffers. The packets get dropped at the interface level. The ' FIFO errors' counter under 'show interface' will show this error. Packets dropped because too much traffic it being sent to virtual sensor than it can handle will be seen as 'missed packet percentage' counter. I shall check if this traffic is dropped or passed through uninspected and let you know. The throughput of the IPS depends on the type of traffic flowing through it. Please check the document below which explains IPS performance with some data for 4270. http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd806e7283.html Hope this helps. Sid Chandrachud Cisco TAC - Security Team ... View more

If the traffic is trusted, create an event action filter to tune IPS for false positives. This way IPS will not carry out the default action on the signature for packets coming from a specific subnet or going to one. Check the video for how to create an event action filter: https://supportforums.cisco.com/community/netpro/security/intrusion-prevention/blog/2010/10/05/cisco-ips--how-to-prevent-false-positives-using-event-action-filters Sid Chandrachud Cisco TAC - Security Team ... View more

Need more information to better understand the issue. 1. IPS can trigger a signature with action as 'deny packet' which is drop the packet. 2. IPS can also initiate a block. With this it sends a shun to ASA to block the ip. Which of the two are you dealting with. For 2. There is a section where you can configure the time for which an IP can be blocked. Checked attached jped for screenshot: Sid Chandrachud Cisco TAC - Security Team ... View more

Please use the link below to download the correct upgrade image: http://www.cisco.com/cisco/software/release.html?mdfid=282671829&flowid=4417&softwareid=282549759&release=7.0%284%29E4&relind=AVAILABLE&rellifecycle=&reltype=latest Latest version: 7.0(4)E4 Filename: Added To Cart IPS-K9-7.0-4-E4.pkg Release Date: 22/JUL/2010 IPS 7.0 Major Upgrade File (All Supported Platforms Except AIM-IPS and NME-IPS) Size: 29767.87 KB (30482298 bytes) For reference: .pkg files are for software upgrade. .img files are for re-imaging the IPS (Erases the configuration) Hope this helps. Sid Chandrachud Cisco TAC - Security Team ... View more

Mustafa, Here are the signature details: http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=5605&signatureSubId=0&softwareVersion=6.0&releaseVersion=S262 This signature detects a Windows SMB user account  that has been locked on the Windows server due to multiple failed logon  attempts, via the "STATUS_ACCOUNT_LOCKED_OUT" message returned to the  client. This signature severity is set by default to 'informational' Hence all the signature is doing is leeting you know some users were locked out due to multiple logon attempts. The event details will also reveal victim ip which might be the machine on which the logon attempts were tried. Let me know if this addresses your concern. - Sid ... View more

How are you seeing the events ? What are you using to check the events ?  IDM, IME ?  Send a screenshot the exact event. In the event details, there would be a signature id.  That signature id will tell us what the signature is designed to match on.  Sid Chandrachud Cisco TAC - Security team ... View more

The correct command is: asa#hw-module module 1 reset This will do a hardware reset on the module. The 'reload' command will only do a software reset. Let me know if that helps. - Sid ... View more