Global Correlation Status

[Rafael Mendes]

Hello Everyone,

i'm trying to enable global correlation, but, after apply the configuration, i see the status bellow:

service global-correlation

network-participation off

global-correlation-inspection-influence aggressive

test-global-correlation off

exit

! ------------------------------

service aaa

exit

! ------------------------------

service analysis-engine

virtual-sensor vs0

physical-interface GigabitEthernet0/1

exit

exit

IPS-SITE-BACKUP#

IPS-SITE-BACKUP#

IPS-SITE-BACKUP#

IPS-SITE-BACKUP# show health

Overall Health Status                                   Green

Health Status for Failed Applications                   Green

Health Status for Signature Updates                     Green

Health Status for License Key Expiration                Green

Health Status for Running in Bypass Mode                Green

Health Status for Interfaces Being Down                 Green

Health Status for the Inspection Load                   Green

Health Status for the Time Since Last Event Retrieval   Green

Health Status for the Number of Missed Packets          Green

Health Status for the Memory Usage                      Green

Health Status for Global Correlation                    Not Enabled

Health Status for Network Participation                 Green

Why the status is "not enabled"?

Obs: Downloads ok via proxy server.

Thanks.

Rafael

[Julio Carvajal]

Hello Rafael,

Why the status is "not enabled

The status is not enabled because the participation of your IPS in the global correlation is off.

There are 3 states related to Global Correlation:

-Full

-Partial

-Off

Please change that and it should working, You need to have a DNS server set up in your IPS, if not Global Correlation will not work.

Julio

Rate the helpful posts

[Rafael Mendes]

Hi Jcarvaja,

The DNS was configured before.

I enable the network participation, but, i don't understand why is necessary enable this, the global correlation

should functional with network patcicipation in mode off too, right? Or not?

Right now, the download is ok and network participation too, but the status still "Not Enabled".

[Rafael Mendes]

Help?

[Julio Carvajal]

Rafael,

On the IDM go to Configuration/Global correlation inpection/reputation and make sure global correlation state is on.

Regards,

Julio