Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

"Shun Host" not working on Routers

Hi,

I am trying to using "Block ACLs" using IDS on a Cisco Router. After required configuration, I can see the IDS sensor logged into the router but no-preblock ACL gets configured. Thus also no Blocking occurs after the signature hit.

There are no pre-configured ACLs on the router. The IDS sensor login to the router using a local username\password and an enable password.

Is there any trouble-shooting that i can do to find the fix for this ?

Thanks,

Naman

3 REPLIES
Community Member

Re: "Shun Host" not working on Routers

As further information to the above problem, below error message appears on IDS console, when "Router Blocking Interface" is configured.

++++++++++++++++++++++++++++++++++++

evError: eventId=1106115977900877382 severity=error

originator:

hostId: ids

appName: nac

appInstanceId: 1968

time: 2006/03/05 21:56:14 2006/03/05 21:56:14 UTC

errorMessage: name=errSystemError ERROR: Invalid interface name [Serial0] for device [195.1.113.3] Try using the name exactly as it appears in the router CLI.

+++++++++++++++++++++++++++++++++++++

The Serial0 interface exists on the device as shown below

++++++++++++++++++++++++++++++

R3#show ip interface br

R3#show ip interface brief

Interface IP-Address OK? Method Status Protocol

ATM0 unassigned YES manual administratively down down

Ethernet0 195.1.113.3 YES manual up up

Ethernet1 unassigned YES manual administratively down down

Loopback0 33.33.33.33 YES manual up up

Serial0 195.3.56.3 YES manual up up

+++++++++++++++++++++++++++++++++++++++++++++

What could be the problem ?

Cisco Employee

Re: "Shun Host" not working on Routers

You didn't mention what version of IDS/IPS software you're running? There could be an issue with the pager in the command output when the IDS logs into the router. If the router inserts a 'More' prompt into a 'show running' or 'show config' response in the middle of a interface block, the IDS may be unable to recognize the interface correctly.

As a workaround you can probably turn off paging on the router. (i.e., term length 0)

Community Member

Re: "Shun Host" not working on Routers

Thanks. I will be able to test this on Saturday.

\\ Naman

283
Views
0
Helpful
3
Replies
CreatePlease to create content