Cisco MARS auto-mitigation

Unanswered Question
Apr 21st, 2007


Is Cisco MARS capable of auto-mitigation, such as applying ACLs or shutting switch ports automatically if anomalous behavior is detected?

Can MARS mitigate automatically without administrator intervention?

Thank you.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
pmccubbin Sat, 04/21/2007 - 08:45

No, MARS does not mitigate automatically without administrator intervention.

MARS correlates all its data to determine the best device and command that can be used to mitigate an attack. It then presents you with the mitigation command it has determined will best stop the attack. There is also a single-click option to deploy the command to the mitigation device, for instance a router, switch, firewall, IPS or ISR router.

Hope this helps.


This Discussion