Turning off blocking

[csimpson]

I am unable to turn off blocking at our border router. I have removed the router and information from the "blocking devices," but every time we get a high alert, it replaces our acl again. What is the resolution for this?

[csimpson]

My current versions are:

4230 sensor 3.0(s4)

cspm 3.0i

[kleem]

Use CSPM to disable managed on the Sensor.

[csimpson]

Where do I go within CSPM to disable managed? It seems that I've looked everywhere.

[marcabal]

Managed is configured to run when configuration entried exist in the Blocking Tab.

This logic is built into the CSPM product so there is not a check box or anything to turn managed on or off.

So to ensure managed does not run:

Click on the Blocking Tab and remove all entries from the following tabs:

Never Block Addresses (Not positive that these have to be removed, but you might want to just in case)

Blocking Devices (Remove these, this tells the sensor which routers to telnet to)

Master Blocking Sensor (Remove these entries as well just to be sure managed is not running.)