CISCO IPS Global Correlation

[gangadaran86]

Hi,

While enabling Global correlation, I understood that we need to configure proxy or DNS.

Also, I hope that needs to open the port (80/443) on the firewall for the management IP address of IPSto reach the cisco sensor database. If i'm correct what about the destination IP, do we need to enable "any" or specific IP is there.

ACL:

Source (IPS Management IP) -> Port (80/443) -> Destination?

[haivrajesh]

Hi,

Global correlation features only contain external IP addresses, so if you position a sensor in an
internal lab, you may never receive global correlation information.

Source (IPS Management IP) -> Port (80/443) -Detination is https://198.133.219.25//cgi-bin/front.x/ida/locator/locator.pl

Regards

Rajeswar