ips 4510 error adding trusted host.

[jamoser]

Hello.

I'm trying to get event logs from my ips 4510 into splunk.

When I add the host on which splunk is running as a "trusted host" I get the error:

Cannot add #.#.#.# as a trusted host.  errTransport-socket connect failed [4,111]

There are no firewalls enabled on the splunk host.

On the splunk side, I've installed Cisco Security Suite and Cisco IPS applications.

The splunk logs show it's able to connect to the host, but then throws the following error:

URLError: <urlopen error Tunnel connection failed: 503 Service Unavailable>.

Not sure at this point if I need to configure something else before being able to add the splunk host as a trusted host?

Any info appreciated.

Thanks.

[sokakkar]

Hi Jamoser,

Could you try to ping the IPS from client? If it works, can you check there is no device in traffic path blocking TCP 443 to IPS? Can you do a capture on IPS to see if request on TCP 443 is indeed reaching the IPS?

-

Sourav