IDS abilities

[fregon]

I'm a little confused on the the abilities of an IDS sensor 4210. I understand that it can monitor, report and stop attacks based on signatures. What I'm a little misled is if the sensor needs to talk to the PIX when an intrusion is detected to shun the attacker, or does the Sensor itself shuns the attacker without talking to the PIX.

Thank you

[kleem]

Since the Sensor is not an inline device, it cannot drop the packets.

The Sensor must be configured to manage a PIX (or router). Then, when a signature is triggered, it sends a shun message to the PIX, which then activates the shun.

[fregon]

Thank you for answering my post. I guess my last question would be when the sensor communicates with the PIX to shun IP's, is there another alternative to or does the communication to the PIX have to be on SSH which requires 3DES encryption on the PIX?

[travis-dennis_2]

The 4210 can also telnet to the PIX

[stleary]

A few notes...

The sensor can telnet to a PIX only if it connects to the PIX inside interface.

Also, the released sensor software has a bug that prevents telnet

connections to version 6.2.1 and later PIXes.

In the current sensor version, only 3des encryption is supported for

SSH sessions.

There is an engineering build available for download from CCO

which fixes the telnet bug. Soon this will be replaced by

an engineering build that also supports SSH sessions with

des encryption.