Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About david
Stats
Member since
04-08-2002
86
Posts
5
Helpful
0
Solutions
Created by
david
in Network Security
in Network Security
06-01-2019
10:08 PM
06-01-2019
10:08 PM
Is there anyway to determine where a certain IPS Policy is being used? For example, you have many IPS policies and hundreds of rules. If I want to figure out which rules are using Intrusion Policy ABC123, is there a way to get this info without having to click on each rule and looking under the Inspection tab? I have not been able to find a way to do this through FMC or Reporting.
... View more
Labels:
Created by
david
in Network Security
in Network Security
04-18-2019
01:28 PM
04-18-2019
01:28 PM
This one has me stumped. I have a host I've been monitoring that has had many dropped events. One event we determined was False Positive so I created a rule w/ action = Trust for traffic destined to this server on a specific port. Solved that issue for now, but there were many other dropped events I was researching. I went in today and no matter what search parameters I use or how far I go back, none of the events are showing up as Dropped? If I remove Dropped from search criteria, I see the events that were previously showing as dropped the other day. What could cause this? How can I use Audit to figure out if someone changed the policy?
... View more
Labels:
03-07-2019
04:54 PM
Thanks Marvin, that was very helpful! One final question, the alert was triggered by a single host behind a single SFR. The current access control policy targets 100+ devices. Is it cleaner to copy/rename both the current IPS and Access Control Policy, edit the copied IPS policy to disable rule state of offending snort rule, edit copied access control policy with a new rule that references edited IPS policy and then assign (Policy Assignment) only to the offending SFR? or is it cleaner to insert a new access rule into the current Access Control Policy? I'm not clear if doing the later forces me to deploy the change to all 100+ devices vs. deploying to a single device.
... View more
03-06-2019
12:03 PM
Thanks guys, is this documented anywhere? I see where you're heading, but not sure of the steps to create new IPS policy to be used in access control rule.
My scenario is this > " If the purpose is to disable only a specific Snort rule (s) for a specific host(s), while leaving other rules enabled, then additional IPS policy with desired configuration can be created and applied in a separate access control rule."
... View more
03-06-2019
06:04 AM
Wouldn't that whitelist it for all IPS alerts? I only want to whitelist if for a specific alert, a specific malware alert that it triggered.
... View more
03-05-2019
12:42 PM
Assuming you're using FMC, how would you exclude a given IP address from a specific IPS alert? For example, system traffic was blocked due to a specific malware definition but it was determined that the traffic was legitimate and you only want to exclude that particular system from being blocked? I've looked in several places but cannot figure out how to do this?
... View more
Labels:
02-21-2019
06:19 AM
Thanks socrates, not what I was looking for right now, but thank you as this is something I will also need to do in the near future!
... View more
02-21-2019
06:14 AM
Thanks Francesco, is there any good documentation on how to pull data via API? I use python scripts to pull data from similar devices but have never tried the FMC API.
... View more
02-20-2019
03:47 PM
Is there anyway to create report on devices in FMC? We have hundreds of devices and I'd like to create a report showing basic info such as device list, model, code rev, etc. I do not see any way to do this?
... View more
Labels:
Created by
david
in Network Security
in Network Security
02-06-2019
05:22 PM
02-06-2019
05:22 PM
App owner complained of blocked traffic. I verified firewall rule was correct and traffic was allowed. I then searched Intrusion events and found that the traffic in question is being dropped by "NETBIOS DCERPC possible wmi remote process launch"
I'm new to Cisco IPS / FMC v6.2. What options do I have to resolve only this issue between the two specific servers without affecting anything else in IPS?
Thanks!
... View more
Labels:
04-11-2018
10:11 AM
It's a RTU (Right To Use) license, meaning with the license you are legally able to use the NDB feature set. You do not need to apply the license or do anything with it or the switch other than keep the license on hand.
... View more
05-04-2016
07:53 AM
Hi All, you would think this would be easy to find, but I'm not having much luck. Is there a guide for setting up and using the built-in Windows 7 VPN client to access a VPN on an ASA?
Is there a compelling reason to use AnyConnect vs. the Windows client? I believe I read that split tunneling is not supported on the Windows client
I've only used AnyConnect in the past, but have a client that insists on using the Windows client instead.
... View more
Labels:
09-14-2015
12:24 PM
never mind guys, got it sorted. What I found is that if you only have 2 switches, you cannot simply type a single command like "switch 1 renumber 2" or "switch 2 renumber 1" because that switch number already exists. What you need to do is type BOTH commands, save the config and reload. For example > switch 1 renumber 2 switch 2 renumber 1 wr mem reload That did the trick....
... View more
09-14-2015
12:02 PM
I must be doing something wrong! I can change the master from one switch to the other, but I cannot get the lower interface numbers to associate with the master / top switch? How can I associate the lower number interface numbers with a specific switch? I want the master to have the 1/0/1, 1/0/2, 1/0/3, etc. numbers.
... View more
Labels:
09-12-2015
01:12 PM
Good stuff Peter, thanks for the clarification! They apparently do not want those subnets advertised due to security concerns. I can break it into smaller summarizations and/or just advertise the individual networks. Thanks Guys!
... View more
06-01-2019
Is there anyway to determine where a certain IPS Policy is being used?
For example, you have many IP...
Created by
david
in Network Security
04-18-2019
04-18-2019
This one has me stumped. I have a host I've been monitoring that has had
many dropped events. One ev...
03-07-2019
Thanks Marvin, that was very helpful! One final question, the alert was
triggered by a single host b...
03-06-2019
Thanks guys, is this documented anywhere? I see where you're heading,
but not sure of the steps to c...
03-06-2019
Wouldn't that whitelist it for all IPS alerts? I only want to whitelist
if for a specific alert, a s...
03-05-2019
Assuming you're using FMC, how would you exclude a given IP address from
a specific IPS alert? For e...
02-21-2019
Thanks socrates, not what I was looking for right now, but thank you as
this is something I will als...
02-21-2019
Thanks Francesco, is there any good documentation on how to pull data
via API? I use python scripts ...
02-20-2019
Is there anyway to create report on devices in FMC? We have hundreds of
devices and I'd like to crea...
Created by
david
in Network Security
02-06-2019
02-06-2019
App owner complained of blocked traffic. I verified firewall rule was
correct and traffic was allowe...
04-11-2018
It's a RTU (Right To Use) license, meaning with the license you are
legally able to use the NDB feat...
Created by
david
in Collaboration Applications
12-21-2016
12-21-2016
Thanks Kelli! that's the behavior I would expect. It would be incredibly
annoying if everyone had to...
Created by
david
in Collaboration Applications
12-20-2016
12-20-2016
When I'm on a webex conference call as a participant, I frequently need
to mute / unmute. When I do ...
05-04-2016
Hi All, you would think this would be easy to find, but I'm not having
much luck. Is there a guide f...
Public Statistics
| Date Registered | 04-08-2002 10:47 AM |
| Date Last Visited | 06-04-2019 01:56 AM |
| Total Messages Posted | 86 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "Hall of Fame Guru"){kind=icon}
.jpg "VIP Advisor"){kind=icon}
