Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

No Shunning on Sig 5343 or 5348

In S37 there are 2 signatures that do not allow for blocking. As a matter of fact they allow for no actions to be taken on the signature at all.

I am administring the appliance sensors via the web interface. Has anyone else experienced this issue or is it a "feature" of those particular signatures?

6 REPLIES
Bronze

Re: No Shunning on Sig 5343 or 5348

There is nothing that should be precluding you from blocking with these signatures. Are you getting an error message of some kind from IDM?

Community Member

Re: No Shunning on Sig 5343 or 5348

Negative. There are just 5 fields displayed when I go into edit that signature.

ID - 5343

Signature - Apache Host Header...

Severity - High (this field is editable)

Action - None

Comments - Apache Host ... (this field is editable)

This is a far cry from the usual fields I get when editing a signature. Should I open a TAC case?

Cisco Employee

Re: No Shunning on Sig 5343 or 5348

If the Action field is set to None and is not editable, then either there

are no legal actions possible, or the legal actions were

accidentally left out. It looks like this might be the latter case.

Investigating...

Bronze

Re: No Shunning on Sig 5343 or 5348

We did indeed have a problem with the S37 signature update package. We will have an S38 package out by the end of this week (Friday), so we won't update S37. I'll post here with a location to the S38 files when they are available. We apologize for any incovenience.

Community Member

Re: No Shunning on Sig 5343 or 5348

Excellent. I appreciate your quick responses and await the new signature update with anticipation.

Ron Russell

Calence Inc

Community Member

Re: No Shunning on Sig 5343 or 5348

It's past the date you indicated, and there is still no S38. Do you have a new ETA?

120
Views
0
Helpful
6
Replies
CreatePlease to create content