cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1291
Views
0
Helpful
1
Replies

Unable to activate or deactivate the Correlation policy

Nazmul Rajib
Cisco Employee
Cisco Employee

After creating a correlation policy with complex conditions, I am unable to activate or deactivate the policy.

1 Reply 1

Nazmul Rajib
Cisco Employee
Cisco Employee

Reason

 

This issue occurs when a complex condition is created, and one of the sub conditions is deleted. In the case below, the correlation rule is missing a sub condition that would have been used together with the Rule Message condition, but it has been deleted. The following screenshot shows a similar situation.

 

 

Workaround

 

The workaround of this issue is to delete the "indented" broken complex condition, and adding it back to the rule as a regular condition.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card