IDSM-2 issues

[Garrison Botts]

I'm having issues where the IDSM-2 is blocking internal users from accessing the internet. When I run a report, I see TCP OVERWRITE errors on the PAT'd address of the firewall (FWSM). I have to reboot the IDSM-2 to get it working again... I'm running the IDSM-2 "inline".

Cisco is telling me that I should put the IDSM-2 behind the firewall but isn't that allowing bad traffic to hit the firewall?

Sent from Cisco Technical Support iPad App

[sawgupta]

Ideally IPS should be behind the firewall, but depeds on your deployment scenario.

What kind of signature do you see firing on IDSM-2 ?

(Check via "show stats virtual-sensor")

http://www.cisco.com/en/US/docs/security/asa/quick_start/ips/ips_qsg.html

"Traffic goes through the firewall checks before being forwarded to the IPS module."

Regards,

Sawan Gupta

[Garrison Botts]

TCP Overwrite signature 1300/0

Sent from Cisco Technical Support iPad App