Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual page 352

System Components
Caution
The PIX Firewall and AAA
Address Translation and Blocking
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
A-26
Do not perform manual blocks or modify the existing PIX Firewall configuration
while NAC is running.
If the block command specifies only the source IP address, existing active TCP
connections are not broken, but all incoming packets from the blocked host are
dropped.
When NAC first starts up, the active blocks in the PIX Firewall are compared to
an internal blocking list. Any blocks that do not have a corresponding internal list
entry are removed.
See Configuring Blocking Devices, page
NAC supports authentication on the PIX Firewall using local usernames or a
TACACS+ server. If you configure the PIX Firewall to authenticate using AAA
but without the TACACS+ server, NAC uses the reserved username pix for
communications with the PIX Firewall.
If the PIX Firewall uses a TACACS+ server for authentication, you use a
TACACS+ username. In some PIX Firewall configurations that use AAA logins,
you are presented with 3 password prompts: the initial PIX Firewall password, the
AAA password, and the enable password. NAC requires that the initial PIX
Firewall password and the AAA password be the same.
If you configure a PIX Firewall to use NAT or PAT and the sensor is checking
packets on the PIX Firewall outside network, if you detect a host attack that
originates on the PIX Firewall inside network, the sensor tries to block the
translated address provided by the PIX Firewall. If you are using dynamic NAT
addressing, the block can be ineffective or cause innocent hosts to be blocked. If
you are using PAT addressing, the PIX Firewall could block the entire inside
network. To avoid these situations, position your sensor on the inside interface or
do not configure the sensor to block.
Appendix A Intrusion Detection System Architecture
10-67, for more information.
78-15597-02