Firesight adding AMP

[bjames]

Hi,

I've just added AMP for Endpoints but when I go into Firesight to add AMP I put in US Cloud then the state just continues to be a spinning wheel. I thought it just took time but I let it run overnight and it's still spinning rather than show the active switch.

Thoughts?

Bob

[pazzi]

Hi Bob,

A few things, maybe simple, but does your Firesight Manager have Internet access? Also, looking at the Health Events, are there any events pertaining to lack of connectivity to the Internet?

Is there a L3 device/FW that might be blocking your Firesight manager access request to register?

Registration takes a few seconds and usually will pop open your AMP console to login and accept your Firesight manager registration, then to select which Groups/Events you want to enable for your Firesight manager.

Paul

[bjames]

FireSight can get to the internet fine, when I click the US Cloud line it takes me to the SourceFire Dashboard just fine, but it's still spinning on the AMP line...

[pazzi]

Hi Bob,

You need to accept the registration from the AMP console. Look under Acounts -> Applications.

Did you select the Groups/Events you want to receive?

[bjames]

Sorry not sure I understand, are you talking about the SourceFire Console (if so there is no Applications under accounts) or Firesight?

[pazzi]

Bob, when you click from the Firesight manager to register with AMP cloud, you get the AMP console login web page. After login, you should see the Accounts->Applications where you see your Firesight Manager's IP address and select which Groups/Events you want to send. See attached images.

Paul

[bjames]

I don't have applications

[pazzi]

Hi Bob,

OK, I see this. I would suggest you contact your support team in regards to this. This would explain why your Firesight Manager's registration is spinning.

Paul

[bjames]

OK I got it working, I deleted the connector in Firesight and recreated it, I was then able to permit firesight communication to Amp for Endpoints and I see the Applications tab now.

Thanks

Bob

[pazzi]

Excellent news!