Solved: denyPacketRequestedNotPerformed+denyFlowRequestedNotPerformed

wmchan1979 · ‎07-21-2009

I am seeing "denyPacketRequestedNotPerformed+denyFlowRequestedNotPerformed" on the Cisco IPS.

The Cisco IPS is running version 6.1(2)E3. The IPS is running inline mode. We are seeing sigID 3616 subsigID 4 was triggered and the above action was noticed. The action taken was set to deny packet inline. However, we are seeing the above message.

Anyone can assist on this issue? Appreciate for the help.

rand.hall · ‎07-23-2009

This is the section of the docs you're looking for:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_ssm.html

On the ASA:

show service-policy ips

or grep your ASA config for the policy map command:

ips {inline | promiscuous] [fail-close | fail-open}

View solution in original post

rand.hall · ‎07-22-2009

See my similar question around Jul-8.

I thought I was in inline mode but was in promiscuous mode.

I have the ASA daughter card. I read the IPS docs upside down and sideways looking for how to get into inline mode. There is a single and (to me) obtuse one line reference that points you to the ASA docs. Indeed, that's where I found the relevant info.

wmchan1979 · ‎07-22-2009

How could we determine if the IPS (daughter card in the ASA) is running promicuous mode or inline mode? Would you be able to send me the doc that you have so that I can read it further? Thanks.

rand.hall · ‎07-23-2009

This is the section of the docs you're looking for:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli_ssm.html

On the ASA:

show service-policy ips

or grep your ASA config for the policy map command:

ips {inline | promiscuous] [fail-close | fail-open}

wmchan1979 · ‎07-27-2009

Thanks. I will give it a try and let you know the findings.

wmchan1979 · ‎08-02-2009

Hi rand.hall,

The IPS was actually running on promiscuous mode as what you predicted. We had changed it to the inline mode now. Thanks for your help. :)