Before Configuring Blocking; Supported Blocking Devices - Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual

Chapter 10 Configuring the Sensor Using the CLI

Before Configuring Blocking

Caution

Supported Blocking Devices

Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
To sum up, before you configure blocking, make sure you understand the
following:
You need to analyze your network topology to understand which devices
•
should be blocked by which sensor, and which addresses should never be
blocked.
Two sensors cannot control blocking on the same device.
• You need to gather the usernames, device passwords, modal passwords, and
connections types (Telnet or SSH) needed to log in to each device.
You need to know the interface names on the devices.
•
• You need to know the names of the pre-ACL and post-ACLs if needed.
You need to understand which interfaces should and should not be blocked.
•
You do not want to accidentally shut down an entire network.
The NAC service supports up to 250 devices in any combination. The following
devices are supported by NAC:
• Cisco series routers using Cisco IOS 11.2 or later (ACLs):
Cisco 1600 series router
–
Cisco 1700 series router
–
Cisco 2500 series router
–
Cisco 2600 series router
–
– Cisco 3600 series router
Cisco 7200 series router
–
Cisco 7500 series router
–
• Catalyst 5000 switches with RSM/RSFC with IOS 11.2(9)P or later (ACLs)
Catalyst 6000 switches with IOS 12.1(13)E or later (ACLs)
•
Sensor Configuration Tasks
10-59