rhermes Tue, 04/08/2008 - 08:49
User Badges:
  • Gold, 750 points or more

If you believe that your IPS is preventing SMTP and POP3 sessions, you need to look at your logs to see what signatures are firing.

Reproduce the problem and at the CLI you can type "show event alert past 01:00" this will show the events for the last 1 hour. Once you find the signature(s) number that have an event action such as Drop, Reset or Shun you can disable those actions for that signature.

Actions

This Discussion