topic What does this IPS message indicate? in Network Security

What does this IPS message indicate?

saidfrh — Sun, 10 Mar 2019 11:25:47 GMT

evError: eventId=1229364010346777529 vendor=Cisco severity=warning

originator:

hostId: IPS

appName: cidwebserver

appInstanceId: 22081

time: Dec 18, 2008 19:30:56 UTC offset=0 timeZone=-8

errorMessage: received fatal alert: certificate_unknown

Messages, like this one, in the category - receipt of TLS fatal alert message - were logged 1795 times in the last 3601 seconds. name=errWarning

Re: What does this IPS message indicate?

marcabal — Thu, 18 Dec 2008 20:49:33 GMT

Soemthing is try to connect to your sensor using an incorrect TLS certificate.

This error is very common in situations where your sensor now has a newer TLS certificate (usually becuase of re-imaging the sensor, or creating a new TLS certificate because the older one expired).

Go to all of your management station boxes and ensure that they have been updated with the sensor's new TLS certificate.

If you are not sure which management boxes may not have been updated, then run the packet display command on the sensor's management interface and look to see which IPs are attempting to connect to your sensor's web server.

Re: What does this IPS message indicate?

saidfrh — Thu, 18 Dec 2008 20:58:29 GMT

What is the command to run "the packet display command on the sensor's management interface and look to see which IPs are attempting to connect to your sensor's web server."

Re: What does this IPS message indicate?

Mon, 12 Jan 2009 20:19:26 GMT

In its simplest form, the command is:

packet display

although there are additional parameters that you can specify. Use ? to see the options.