It may be possible that the configuration modification made in the IDSMC was not pushed to the sensor, or the push of the configuration to the sensor has failed.
If you are still receiving 2100 alarms from the sensor then ssh to the sensor and type of the following commands:
service virtual-sensor-configuration virtualSensor
signatures SIGID 2100
Look at the setting for the Enabled parameter:
If it is set to True then the configuration change to Disable the signature did not get properly pushed to the sensor.
If it is set to False then the configuration change to Disable the signature did get pushed to the sensor. If Enabled is set to False, but the sensor continues to generate 2100 alarms then contact the TAC.
NOTE: If instead of Disabling the signature you meant that the signature was Filtered through IDS MC then could be that the generated alarms are not being properly matched by the created filter.
This often happens when enough of the alarms are firing to cause the alarm to go into Global Summary Mode where the IP Addresses are being replaced with 0.0.0.0 and will not match the filters you had created. In these scenarios it is best to Disable the signature, or configure the signature with the highest possible ChokeThreshold to prevent it from going into Global Summary mode.
I would need to see the actual alarms being created and the output from the following commands on the sensor to determine what is happening:
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...