cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
812
Views
0
Helpful
2
Replies
Highlighted
Beginner

IPS Alerting to multiple locations

Will adding multiple alerting destinations have a dramatic CPU impact

over a single destination when under significant alerting load?

1 ACCEPTED SOLUTION

Accepted Solutions
Rising star

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

2 REPLIES 2
Rising star

Re: IPS Alerting to multiple locations

If your sensor is not overloaded today, it's doubtfull that adding an additional SDEE feed will push it over the edge. But if you're already showing a missed packet percentage in your logs, then adding another event feed won't do your sensor any favors.

- Bob

Cisco Employee

Re: IPS Alerting to multiple locations

In addition to Bob's points, please be aware that Cisco's IPS sensors have a limit to five (5) open SDEE subscriptions; this equates to five (5) "alerting destinations". If you configure more than five (5) you may encounter subscription contention and inconsistent events being logged at each destination.

Scott

CreatePlease to create content
Content for Community-Ad
August's Community Spotlight Awards
This widget could not be displayed.