Alerts

[prashantrecon]

Hi All,

I have tunned signatures for u torrent to get alerts on ips.

Used utorrent on pc  to download software but still i am not receving any events on ips.

What may be the issue.Ping and traceroute works fine from pc to ips.

Can anyone guide to tune basic signature to get alerts on ips?

[Julio Carvajal]

Hello Prashant,

Do you get events with ICMP traffic?

Regards

[prashantrecon]

Hi ,

By default in IPS icmp echo reply and echo request signature is disable.

i getting only events related to global correlation.(curreltly i am not using global correlation , i have not configured it)

Regards,

Prashant

[Julio Carvajal]

Hello Prashant,

By default in IPS icmp echo reply and echo request signature is disable.

Exactly so why dont you enable it and set it to generate an alert so you can see them??

I mean I dont think I understand your question is this is not what you are looking for!!!

[prashantrecon]

Actually my issue is that for example if i enable the Echo reply and echo request signature and when i ping to any website or ip i am not getting any alert on my ips.

and also if i am looking for last 72 hours events in cisco ASDM for ips i am not getting any events except ""

A global correlation update failed: openConnection: ""

About 15 days before i am able to see last 24 hours events(example dos attacks)

any clue why there is no events generating in IPS.

Regards,

Prashant

[Julio Carvajal]

Can you share the running configuration for that particular signature, or take some captures related to the signature configuration and post it here.

[prashantrecon]

Hi,

let take a example echo reply and echo request .

Can you help me to take capture and running cofig for above mention signature.

Reagrds,

Prashant