topic Re: IDS & Cisco Works SIMS in Network Security

IDS & Cisco Works SIMS

m.rainer — Sun, 10 Mar 2019 09:10:04 GMT

Hello,

I try to integrate a IDS 4.1 appliance to Cisco Works SIMS 3.1 (Netforensics) . But I fail for 2 days now. I can see that the CSIDS4 agent tries to connect to the IDS sensor with TCP port 443 but in the logs I always can see a "failed to conntect host".

I configured the "NF CSIDS Agent":

"Date Processor Data1" -> "CSIDS4 AGENT PROTOCOL" -> "MODE = SECURE"

There is a field: "signature"

Do I need fill out that field? What is the correct input for that field?

Or ist "mode" secure the wrong mode?

Has anybody integrated a Cisco IDS 4.1 to NetForensics 3.1 successfully?

PLEASE HELP!

Thanks a lot

Markus

Re: IDS & Cisco Works SIMS

ishah — Fri, 15 Oct 2004 22:24:02 GMT

Hi,

Ensure the SIM IP is in allowed hosts section in the Sensor configuration. This is what you see usually when that bit isn't configured.

Also try this link

http://www.cisco.com/application/pdf/en/us/guest/products/ps5209/c1067/ccmigration_09186a008017e174.pdf

Re: IDS & Cisco Works SIMS

m.rainer — Mon, 18 Oct 2004 06:37:53 GMT

Hello,

Thanks for the answer.

I have done that before, thats not the failure. I found that document "configuring and maintenance" before. But I only can find a description how to configure the IDS sensor and no documentation regarding the configuration NET Forensics.

Any further hints?

Thanks a lot

Markus

Re: IDS & Cisco Works SIMS

m.rainer — Mon, 18 Oct 2004 07:32:24 GMT

Hello,

On the IDS Sensor I found that error events:

evError: eventId=1050261859615885102 severity=error

originator:

hostId: idssensorgraz01

appName: cidwebserver

appInstanceId: 11821

time: 2004/10/18 07:28:23 2004/10/18 09:28:23

errorMessage: name=errUnclassified srvcReq protoErr: unexpected_message [10,0]

2. evError: eventId=1050261859615885103 severity=error

originator:

hostId: idssensorgraz01

appName: cidwebserver

appInstanceId: 1153

time: 2004/10/18 07:28:23 2004/10/18 09:28:23

errorMessage: name=errTransport WebSession::sessionTask(4) TLS connection exception: handshake incomplete.

Maybe that helps?

Markus

Re: IDS & Cisco Works SIMS

lkc — Mon, 20 Dec 2004 23:51:10 GMT

Did you ever find out what the issue were ?? I may be in a similar situation ?

Regards,

Lasse

Re: IDS & Cisco Works SIMS

m.rainer — Tue, 21 Dec 2004 17:22:05 GMT

Hello Lasse,

Yes I found out what it was. You have to configure "secure" Port: 443 and NO CERTIFICATION has to be added.

It works no for a while.

I do not know why there is no documentation regarding that point!

Best regards

Markus

Re: IDS & Cisco Works SIMS

ebatur — Wed, 22 Oct 2008 15:37:29 GMT

Hello. Do you still have access to a Cisco SIMS Engine?

Re: IDS & Cisco Works SIMS

ebatur — Wed, 22 Oct 2008 15:38:19 GMT

Hello. Do you still have access to a Cisco SIMS Engine?

Re: IDS & Cisco Works SIMS

ebatur — Wed, 22 Oct 2008 15:39:14 GMT

Hello. Do you still have access to a Cisco SIMS Engine?