Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Nachi detected from 3015 Concentrator?

Our IDS shows each day about 20 nachi alarms orginating from the private ip address of our 3015 vpn concentrator and I'm at a loss to explain it.

This occurs regardless of clients being connected or not. ICMPs are filtered and dropped both in and outgoing on the box.

The IDS signature shows the nachi alarms as coming from and to port 0, which also seems strange.

Does anyone know what could be causing this?

Btw we are running 3.x of IDS - have yet to upgrade to 4.x

2 REPLIES
Silver

Re: Nachi detected from 3015 Concentrator?

This is basically due to the limitations of 3.1 code. 4.0 should not have any such problems.

Bronze

Re: Nachi detected from 3015 Concentrator?

Could you please send a traffic sample directly to me at mcerha@cisco.com. I will look into the exact cause.

98
Views
0
Helpful
2
Replies
CreatePlease to create content