IPS-4420 Global Correlation status critcal

[ketanpatani]

How to check in the IPS 4420 is Globel correlation license are there or not?

In IDS 4420 IDM event montor page I am facing two below problem

1. Event Retrieval       =========== Critical

2. Global Correlation  =========== Critical.

I configure IPS box got to the Internet without proxy. But I don't how to check the IPS are connected to Cisco Global Correlation server?

Why its shwoing critcal on Event Retrieval and Global Correlation.

[Jennifer Halim]

Are you planning to use the Global Correlation feature?

Here is the information on Global Correlation for your reference:

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_collaboration.html

If don't want to use that feature, you can disable that in the sensor health metric section so it's not showing Critical.

Similarly, for Even Retrieval, you can just disable that in the sensor health metric section. This is only useful if your IPS events are retrieved by an external monitoring system, eg: IME.

http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_sensor_management.html#wp2117358

Message was edited by: Jennifer Halim

[PAUL GILBERT ARIAS]

Jennifer, does this requires a separate license or it just needs the same license for signature updates?

[Jennifer Halim]

No extra license is required, it's the same license as the signature update license.

[PAUL GILBERT ARIAS]

thanks