Is the Security Manager icon displayed only for events that have 5-tuple data?
A. No.The Security Manager policy table lookup icon in CS-MARS is displayed for access rules from a PIX firewall, ASA device, IOS router, or an FWSM blade, regardless of whether the 5-tuple information is available or not. If the 5-tuple data cannot be derived from the syslog, the most accurate match is displayed after policy table lookup.
Related Questions
- Why am I not seeing the Security Manager icon for Packet Data and Context Data events, although they are events reported by Cisco IDS 4.x and Cisco IPS 5.x devices?
- What are the types of CS-MARS events for which the Security Manager icon is displayed?
- Is the Security Manager icon displayed only for events that have 5-tuple data?