topic Re: global correlation can't updated in Network Security

global correlation can't updated

bh_zhi — Sun, 10 Mar 2019 12:01:20 GMT

version is IPS7.0, asa5520-aip-ssm.
Singatrue and IME can be sucessfully updated,
Global correlation can't updated,
the Status of global correlation is Critical.
I saw the website
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/ime/ime_collaboration.html#wp1053280
and updated following the web page. But can't work it.

How could I update global correlation
or go back old sensorbase?

Re: global correlation can't updated

Scott Fringer — Wed, 09 Jun 2010 10:37:23 GMT

Have you configured a DNS server or proxy server on your sensor? Global correlation relies on the ability to resolve the update server's name to IP address. Your screen-shot seems to indicate this is the likely issue as it reports "Unknown" for the Update Server Address.

You can add a DNS server by navigating to Configuration>Sensor Setup>Network

Scott

Re: global correlation can't updated

bh_zhi — Fri, 11 Jun 2010 06:22:31 GMT

DNS has configured as cisco's web page said,

updated information: update server:update-manifests.ironpo

update server address: unkown

the website is ips itself contains,

whether should I change the website to update global correlation or not

and which website is right can you tell me ?

Re: global correlation can't updated

edadios — Fri, 11 Jun 2010 07:23:55 GMT

The site is "update-manifests.ironport.com"

Is this what you have configured? If not, correct it to the above.

Regards,

Re: global correlation can't updated

Scott Fringer — Fri, 11 Jun 2010 10:33:46 GMT

The output provided clearly indicates that the AIP-SSM is unable to resolve the update server address. The server name update-manifests.ironport.com is not user configurable.

Do you have more than one DNS server configured? If so, disable all but the primary DNS server.

If you only have one DNS server configured, please verify the AIP-SSM's management IP address has unrestricted access to the Internet. (At a minimum TCP ports 80 and 443 and UDP port 53).

Scott