Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

FWSM and shunning?

Can an IDS management station send shunning configurations to the FWSM?

  • Other Security Subjects
3 REPLIES

Re: FWSM and shunning?

Yup, though to be more correct, the shun commands are coming from the IDS sensor itself rather than the IDS Management Station. The sensor opens a telnet/SSH session to the FWSM and issues the commands as needed. Hope this helps.

Scott

New Member

Re: FWSM and shunning?

Did you try this Scott? Do you know for sure that it works?

I'm receiving an error in my IDS event log that the version of the FWSM is not supported (1.1 & 2.2, I tried both)

Any suggestions? Thanks in advance.

Re: FWSM and shunning?

I am guessing you are seeing something like this:

evError: eventId=1088050941971244051 severity=error

originator:

hostId: IDSM-

appName: nac

appInstanceId: 27739

time: 2004/06/30 03:09:34 2004/06/30 03:09:34 UTC

errorMessage: name=errSystemError Device [PIX] IP [] Version [2.2] not supported.

If so, this error message can be ignored. The reason it is printed is because version 4.0 sensors expect the version of PIX to be greater than 6.0. In the case of a FWSM, this message can be ignored. Version 5.0 of the IDS code will officially support FWSM code.

But yes, I have seen shuns to the FWSM work. Issue a 'sh shun' on the FWSm after an alarm has triggered a shun and you should see it listed.

Hope this helps.

Scott

129
Views
0
Helpful
3
Replies
This widget could not be displayed.