cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
454
Views
0
Helpful
1
Replies

IPS 4260-70 Events to Saalt - RSA using PORT 443

edgonzales_1996
Level 1
Level 1

I have a request to send all IPS 4260-70 on os vs 7.0.4(e4)  Events to Saalt - RSA using PORT 443.  I created an admin account, how do you configure the port 443?

1 Reply 1

Scott Fringer
Cisco Employee
Cisco Employee

Edwin;

  Cisco's IPS sensors do not send events by default; they make use of the Security Device Event Exchange (SDEE) protocol in a client-server implementation (the IPS being the server and the remote application being the client).  By default, the IPS will listen on TCP port 443 for SDEE connections requesting events or opening a SDEE subscription.  The remote application (Saalt?) should require configuring the IP address of the IPS and a username/password for logging into the IPS.  The IPS will need an access list entry for the remote application host to allow successful communication.

Scott

Review Cisco Networking for a $25 gift card