Hi all, to enable strong authentication with RSA products on a PIX (even with PIX OS 6.3) you a need a RADIUS server which can act as a proxy for the RSA Security SecurID ACE/Server. This last server has its own embedded RADIUS server which you can use (no need to have a "dedicated RADIUS"). At the following link you can find more information about PIX and RSA Security products interoperability: http://rsasecurity.agora.com/rsasecured/detail.asp?product_id=335 Hope this helps ... Regards, Sonia --------------------------------------- Sonia Valerio - GCFW, CISSP, CSS1 System Engineering (Security) Uniautomation S.p.A. Via V.Toffetti, n.25 I-20139 Milano Italy http://www.uniautomation.it ... View more

Hi Stefano, as far as I know the PIX does not provide any traffic shaping capability, but it supports QoS in the sense that it preserves the ToS field value of an IP packet while forwarding the packet to its destination. This same feature is supported also when encryption is enabled (it is a standard IPSec feature which Cisco implements on every VPN-capable device/software, with the only exception of VPN software clients). Hope this helps ... Regards, Sonia ... View more

Hi Mike, with the new 4.1 software version of IDS 4200 appliances (which has been recently released by Cisco) you shouldn't have any problem when monitoring more than one switched network segment, since this new release enables a full multiport monitoring capability on the appliances. You can configure your 4250 IDS sensor to monitor traffic flows over a maximum of 5 network segments (not sure if you can configure a different "policy" for every interface - don't think so ...). The basic idea could be the following: - enable port monitoring on the switches ("copy" the traffic flow you want to observe to the switch span port); - connect one of the interfaces of your 4250 to the switch span port. The only thing to be carefully minded is the aggregated bandwidth limit of the appliance itself: the total amount of traffic you are monitoring cannot exceed thee 4250’s limit of 500 Mbps (or 1000 Mbps in case of the XL model). With 4.0 software version multiple sniffing interfaces were not supported, although the hardware was ready for the job; so in my previous answer I was suggesting a different solution, based essentially on a load balancing mechanism. As far as management issues are concerned you can find more information following this link: http://www.cisco.com/warp/customer/707/idsfaq.html#Q33 I think that, unfortunately, you won’t be able to manage the sensor using CSPM, as reported from Cisco: http://www.cisco.com/en/US/partner/products/sw/secursw/ps2133/prod_release_note09186a00800d9cc3.html#xtocid3 (supported devices list for CSPM 2.3.2i) http://www.cisco.com/en/US/products/sw/secursw/ps2133/products_device_support_table09186a00800e6d44.html (supported devices list for CSPM 3.1) Management options for IDS 42xx are: - CLI (connection to a single device at a time) - IDS Device Manager (via browser - connection to a single device at a time) - Cisco VMS – this is a replacement of CSPM You can find something about VMS here: http://www.cisco.com/en/US/products/sw/cscowork/ps3990/index.html http://www.cisco.com/en/US/products/sw/cscowork/ps3990/products_qanda_item09186a00800e55b8.shtml Hope this helps ... Regards, Sonia ... View more

I don't think you can have a new PIX OS for free without any support contract. If you take a look at the following web page (at the end of the page) you can see that a package exist for customers without a valid support contract. http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheet09186a0080148714.html This package, as far as I know, has a reasonable cost and consists of a CD with the latest PIX OS version and documentation. Hope this helps to solve your issue. Regards, Sonia ... View more

Hi, I'm not an expert of this, but I'll try to give some suggestions. Very often NFS uses dynamic ports that are "communicated" via the portmapper which listens on port 111, although most NFS servers tend to use UDP port 2049 (maybe according to a recommendation, not properly a requirement). As far as IRC is concerned, in general, the port used is 6667. Some servers listen to other ports usually in the 6660-6670 range. On the folloqing web site: http://www.irchelp.org you can find a lot of information about this subject. Hope this helps ... Regards, Sonia Security System Engineer SANS/GIAC Certified Firewall Analyst (GCFW) - http://www.giac.org/GCFW_400.php - ... View more

As far as I know multiple sniffing interfaces will be available only with IDS version 4.1 (not released yet); so, at the moment, I think the only possibility is to use one IDS per segment, depending on what exactly has to be monitored. In an attempt to avoid "noise" - traffic flows which the border router and the firewall will almost certainly block usuallly need not to be monitored - I wuold put the IDS behind the firewall. Properly configuring SPAN ports on the switches where IDS systems are connected, and eventually using a load balancer supporting a specific "IDS load balancing" algorithm, could help in realizing an IDS system which keeps constantly under control both active and failover links. Every IDS should be connected to the IDS balancer which receives copies of traffic flows coming from the switches and send them to IDS systems. Hope this helps ... Thanks, Sonia ... View more