08-03-2009 01:54 PM - edited 03-10-2019 04:43 AM
Hello,
We are noticing a strange behavior with several IPS AIM modules and IPS Appliances. Events are generated and can be seen from the event viewer but nothing is displayed on the Network Security Gadget on the Dashboard.
We've verified and compared configurations with other working Appliances and can't find why the count event on the dashboard is 0 while the event viewer is showing several events. We've tested from different computers with different Java versions to rule out a problem with the viewer, but the result is the same.
IPS is working and denying traffic if configured, the event action overrides are configured to produce alert for all severities (to test).
We've seen this on Appliances and ASA IPS modules running 7.0(1)3, 6.0(5)E3 and other 6.x versions, the only common denominator we can see is the E3.
It's a difficult event to troubleshoot and I haven't found any reports from similar behavior, has anyone noticed something similar?
Any ideas on where to look will be greatly appreciated.
Regards,
02-16-2010 11:59 AM
I have been able to get the Events to display in Realtime, but the Network Security Gadget still does not show anything above 0.
Not sure if you have that issue as well.
Thank you,
Gino
02-17-2010 05:36 AM
No, sorry. I didn't recheck the Network Security gadget after the events started appearing. Everything on the events dashboard is now working, but I still have no events in the Network security gadget.
10-26-2010 02:12 PM
Wow! so no solution on this yet.
I have a new implementation now and Cisco suggested us to use version 6.0(4) for all our IPS modules and appliances. I'm looking forward to upgrading but I cant find a newer version that seems stable enough (i.e. the network security gadget not working).
On your experience would you recommend the 7.x version you are using for your IPS?
Thanks and regards,
10-26-2010 02:38 PM
Hi.
I am using Version 7.0(2)E4 for over a year now, and it is stable, but I like the old version better. It actually looks like it is doing something. Without the Gauge, it is deceiving. We have had a few card failures recently, but I don't know if it is the card or the software.
To me, if you keep your IPS up to date with the latest protection downloads, it is good enough. This version does not seem to give you anything better.
Regards,
Gino
Gino DiCarlo | Network Communications | International Derivatives Clearing Group | 150 East 52nd Street, New York, NY 10022 USA | Office 646-867-2533 | Cell 646-824-8380 | gino.dicarlo@idcg.com
10-26-2010 02:45 PM
Thanks! I think I'll wait to see if the 7.1 ever comes out!
Regards!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide