topic Re: IPS 7.0 - global correlation not updating in Network Security

IPS 7.0 - global correlation not updating

George Thomas — Sun, 10 Mar 2019 11:39:37 GMT

Hello,

I am having issues with the IPS sensor not doing the global correlation updates. The IPS module has access to the internet and I can ping the server which serves the updates. Anything else to be checked?

Re: IPS 7.0 - global correlation not updating

George Thomas — Wed, 10 Jun 2009 14:52:30 GMT

To add to the previous post, I am seeing the following error:

08Jun2009 collaborationApp[465] rep/E A global correlation update failed: openConnection: Caught IpAddrException badAddrString

Messages, like this one, in the category - Reputation update failure - were logged 24 times in the last 7200 seconds.

Re: IPS 7.0 - global correlation not updating

abinjola — Thu, 11 Jun 2009 06:54:50 GMT

the issue that you are experiencing is due to a new feature that is turned on by default in the 7.0(1)E3 called Global Correlation. You are receiving the health critical messages because the IPS is not setup to allow the Global Correlation updates. You can turn this

Global Correlation feature off in IME by going to Configuration->Policies->Global

Correlation and turning off the Inspection/Reputation and Network Participation settings.

If you want to use this feature you will need to setup a proxy or DNS on the

IPS

Re: IPS 7.0 - global correlation not updating

George Thomas — Thu, 11 Jun 2009 12:24:02 GMT

Hi Ashish,

I understand that Global Correlation is a new feature. I am trying to get it to work so that it can go fetch updates but it doesnt work. The IPS module has the required DNS servers listed and also Internet connection. But still it doesnt work.

Thanks,

Re: IPS 7.0 - global correlation not updating

abinjola — Thu, 11 Jun 2009 13:10:43 GMT

Have you configured DNS or proxy server as per

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/cli/cli

_setup.html#wpxref67214

Re: IPS 7.0 - global correlation not updating

George Thomas — Thu, 11 Jun 2009 13:15:57 GMT

Hi Ashish,

I have configured the DNS servers and the IPS module can ping the DNS server. I can also ping the IP address to which IPS is going to go to download the updates from.

Thanks,

Re: IPS 7.0 - global correlation not updating

abinjola — Mon, 22 Jun 2009 12:06:42 GMT

sorry for the late response...

You may be hitting CSCsy29617 Sensor unable to download global correlation update files

Re: IPS 7.0 - global correlation not updating

Bill CARTER — Mon, 22 Jun 2009 12:56:20 GMT

You need to setup a static NAT for the IPS address. That is kind of left out/hidden in the configuration documents.

Re: IPS 7.0 - global correlation not updating

George Thomas — Mon, 22 Jun 2009 12:59:24 GMT

Hi guys,

Thanks for your responses. I figured out what the issue was. I didnt have Network Participation turned on. As soon as I turned it on and restarted the module, everything seems to work fine. I dont have static NAT entry for it.

Thanks,

Re: IPS 7.0 - global correlation not updating

MARK BAKER — Mon, 24 Aug 2009 15:55:03 GMT

I was having issues updating the Global Correlation feature as well. From a packet capture, I found that the sensor was trying to open an http connection to two IP addresses (97.65.135.170 and 97.65.135.137). After I allowed this in addtion to the update-manifest.ironport.com IP address for https, the updates started working.

I do not have Network Participation enabled.

Mark

Re: IPS 7.0 - global correlation not updating

rsmith — Tue, 15 Sep 2009 14:49:04 GMT

Try adding some or all the following IP addresses for access to the device:

204.15.82.17

207.15.82.17

97.65.135.170

97.65.135.137

208.90.57.73

209.107.213.40

198.133.219.25

77.67.85.33

77.67.85.9