cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
439
Views
0
Helpful
1
Replies

IPS 7.0.2 & Global Threat Correlation

Ronald Nutter
Level 1
Level 1

I have two of my SSM sensors running on 7.0.2 and recently turned on Global Threat Correlation.

Network Participation Status shows as OK.

Under Counters under Network Participation - All are showing zero.

Under Global Correlation Updates, Status of Last Update Atempt shows Failed, and Time Since Last Successful Update shows never.

This would seem to say that I am not getting Threat Correlation updates but I see the sensor getting some type of update as I have seen its signatures get updated.  I have a packet capture running on the ASA that faces the internet and it sees request coming from the one ASA I am working on now.

I have looked for troubleshooting info and havent been able to find any.

Any suggestions ?

Ron

1 Reply 1

praprama
Cisco Employee
Cisco Employee

Hi Ron,

Could you post the output of "show statistic global-correlation" from the sensor. Also, please post the output of "show config" after removing all the IP addres details.

Thanks and Regards,

Prapanch

Review Cisco Networking for a $25 gift card