| 12.5 |  | Shunning |
| 12.5.1 |  | Overview of shunning |

| The PIX Security Appliance shun feature, when combined with a Cisco IDS Sensor, allows the PIX to dynamically respond to an attacking host. This prevents new connections and disallows packets from any existing connection. A Cisco IDS device instructs the PIX Security Appliance to shun sources of traffic when those sources of traffic are determined to be malicious.

The shun command is intended for use primarily by a Cisco IDS device. The shun command applies a blocking function to an interface receiving an attack. Packets containing the IP source address of the attacking host are dropped and logged until the blocking function is removed manually by the administrator or dynamically by the Cisco IDS master unit. No traffic from the IP source address is allowed to traverse the PIX Security Appliance, and any remaining connections time out as part of the normal architecture. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active.

The offending host can be inside or outside of the PIX Security Appliance. If the shun command is used only with the source IP address of the host, no further traffic from the offending host is allowed. PIX Security Appliance shunning is supported in Cisco IDS 3.0. More information about the shun command is available in the Command Reference.

| Web Links IDS Sensor information http://www.cisco.com/en/US/ products/hw/vpndevc/ps4077/index.html http://www.cisco.com/en/US/products/
hw/modules/ps2706/ps5058/index.html