An IPS sensor will log into a FWSM and put in and take down host blocks when it shuns a host. If you set the IPS to telnet for it's connection to the FWSM, you can capture the session (Ethereal has a wonderful "follow TCP session" for seeing this) and see the exact commands and logic employed. There is no reason you can not script a telnet or ssh session from your linux host to change host blocks. However, if you have more than one device doing this, you can get into some problems. The IPS sensor assumes it is the only blocking device and will clear all blocks that it didn't create.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...