IDS & Cisco Works SIMS

[m.rainer]

Hello,

I try to integrate a IDS 4.1 appliance to Cisco Works SIMS 3.1 (Netforensics) . But I fail for 2 days now. I can see that the CSIDS4 agent tries to connect to the IDS sensor with TCP port 443 but in the logs I always can see a "failed to conntect host".

I configured the "NF CSIDS Agent":

"Date Processor Data1" -> "CSIDS4 AGENT PROTOCOL" -> "MODE = SECURE"

There is a field: "signature"

Do I need fill out that field? What is the correct input for that field?

Or ist "mode" secure the wrong mode?

Has anybody integrated a Cisco IDS 4.1 to NetForensics 3.1 successfully?

PLEASE HELP!

Thanks a lot

Markus

[ishah]

Hi,

Ensure the SIM IP is in allowed hosts section in the Sensor configuration. This is what you see usually when that bit isn't configured.

Also try this link

http://www.cisco.com/application/pdf/en/us/guest/products/ps5209/c1067/ccmigration_09186a008017e174.pdf

[m.rainer]

Hello,

Thanks for the answer.

I have done that before, thats not the failure. I found that document "configuring and maintenance" before. But I only can find a description how to configure the IDS sensor and no documentation regarding the configuration NET Forensics.

Any further hints?

Thanks a lot

Markus

[m.rainer]

Hello,

On the IDS Sensor I found that error events:

evError: eventId=1050261859615885102 severity=error

originator:

hostId: idssensorgraz01

appName: cidwebserver

appInstanceId: 11821

time: 2004/10/18 07:28:23 2004/10/18 09:28:23

errorMessage: name=errUnclassified srvcReq protoErr: unexpected_message [10,0]

2. evError: eventId=1050261859615885103 severity=error

originator:

hostId: idssensorgraz01

appName: cidwebserver

appInstanceId: 1153

time: 2004/10/18 07:28:23 2004/10/18 09:28:23

errorMessage: name=errTransport WebSession::sessionTask(4) TLS connection exception: handshake incomplete.

Maybe that helps?

Markus

[lkc]

Did you ever find out what the issue were ?? I may be in a similar situation ?

Regards,

Lasse

[m.rainer]

Hello Lasse,

Yes I found out what it was. You have to configure "secure" Port: 443 and NO CERTIFICATION has to be added.

It works no for a while.

I do not know why there is no documentation regarding that point!

Best regards

Markus

[ebatur]

Hello. Do you still have access to a Cisco SIMS Engine?

[ebatur]

Hello. Do you still have access to a Cisco SIMS Engine?

[ebatur]

Hello. Do you still have access to a Cisco SIMS Engine?