VMS IDS MC ACL Violation

[g.schaarup]

How to find/define the "ACL Violation" TOC/Object (that is the "ACL Violation" handle is missing from my VMS MC IDS).

As I need the "ACL Violation" feature I hope someone can tell why its missing from the possible objects in the Sensor Configuration>Settings>TOC>Signatures> ?

My setup is as following:

CiscoWorks Common Services 2.2 with SP2

IDS MC 1.2 patch 3

Sensors Platform: IDS-4230 Version 4.1(3)S68

[nikhil_m]

Any update on this? thanks.

[marcabal]

The ACL Policy Violation signature are now handled by the "Service.Syslog" engine in version 4.x.

You need to create a custom signature based on the Service.Syslog engine and place the ip address of the router in the AclDataSource field and the name ofthe ACL in the AclFitlerName field:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swappa.htm#788774