No particular order (that I am aware of).
As far as Security Monitor to monitor IDS Alerts, I choose the hard way and just manually added each of our devices, tedious but all is working.
As far as Performance Monitor, I imported from RME
The bulk of our routers run 12.3(11)T and 12.3(11)T2.
We have a ton of 831's and I choose for them to send alerts via PostOffice rather than waiting for collections via SDEE because the memory in the 831's (48MB) are already just about maxed out (Regularly over 80%) just running the daily needed applications (VPN and CBAC). We have some 1700s and 2600s out in the field too that are not as taxed.
if you choose the PostOffice route (or test it out) then here are the commands and steps you need:
First add the device in Security Monitor to use PostOffice
then from the router console, ssh, etc........
ip ips notify nr-director
ip ips po max-events 100
ip ips po remote hostid [VMS Host ID#] orgid [ORG #] rmtaddress [VMS IP Address] localaddress [Router IP Address] port 45000
ip ips po local hostid [Router Host ID#] orgid [Org ID#]
exit
write mem
reload
Once you reload it will send an initial packet to VMS and the router will register as 'Connected' in Sec Monitor.
You should make sure that the 'ip ips po' commands are accepted in your IOS version
____________________________________________________
I don't know what your memory consumption is like in your 2800 Router but the config for SDEE Event Collection is much less involved. If your router has resources to spare this is the way to go.
