Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
The Cisco website states that an 1841 w/VPN-AIM will support up to 800 IPSec encrypted tunnels. http://www.cisco.com/en/US/products/ps5853/products_data_sheet0900aecd804ff58a.htmlWhen I do my own IPSec tunnel scalability test it fails at 255. I'm f...
A few MARS questions regarding SAV CE.1. Can someone explain why MARS would need to import a list of the SAV clients? Why does it need to store each host as a reporting device when the traps are coming from the SAV server?2. If my SAV admin adds new...
New IDSM2 installation here. Just got them to work last week so no real tuning done yet. They are running in promiscuous mode with software version 5.0(5sp2). We are using CN-MARS 4.1 to collect events.I'm seeing a lot of RPC DCOM overflow events ...
Hello All,We recently added IDSM2s to our core using VACLs to capture traffic. How are others controlling which VLANS the IDSMs can inspect? Currently I have it set up where only certain VLANs are mapped on the VACL and allowed on the trunk. e.g. ...
Hello,We recently installed our IDSMs and a MARS box to monitor our core traffic. I'm trying to set up a MARS "User Inspection Rule" to notify me when there is FTP traffic on a port other than port 21. Is there an easy way to do this? I don't see a...
I'm trying to understand this command on the Nexus as well. On Brocade switches they use a similar command which restricts the management plane to that vlan interface. If you don't use the management command then any vlan interface can be used for ...
Wow, Cisco really needs to put some work into improving their MARS email notifications. Our mail servers are bouncing the email because the account "notifier.hostname" does not exist for ourdomain.com. Our mail server does a sender account lookup a...
Has this issue been fixed yet? I can't seem to find a way to change the sender address in the notifications sent from Mars. It looks like MARS is using the format of "notifier.hostname@domain.com" which keeps getting bounced by our email servers be...
Yep. I used these instructions listed in the user guide: http://www.cisco.com/en/US/products/ps6241/products_user_guide_chapter09186a00804f711a.html#wp1033094The SAV administrator for our campus provided the exported CSV file from the SAV server. Ap...
