This document describes how to check what are changes in the signature behavior that have been made when a new signature pack has been updated on the IPS in additon to the new signatures that are introduced.
Most of the times, customers report issues with the traffic flows being impacted/specific application observing packet drops after signature update has been performed on the IPS. So the key for troubleshooting such issues would be to understand what are changes that are made to the active signature set after the signature update process completed.
Step 1 :
The first thing that we need to check is the upgrade history for the signature. This would tell us the previous signature pack that was running on IPS and the current version of signature pack.
This can be found out from the output of the command "show version" or from the upgrade history section of the "show tech". Snippet from the same is mentioned below:
* IPS-sig-S733-req-E4 19:59:50 UTC Fri Aug 09 2013
IPS-sig-S734-req-E4.pkg 19:59:49 UTC Tue Aug 13 2013
Now from the above we can make out that the previous signature pack that was running on the IPS was s733 and has been upgraded to s734 which is current signature pack.
Step 2 :
The second step is to understand the changes that have been made which can be checked through the IME/IDM. Screenshots of how to check the same has been shown below:
ScreenShot1 : Displays the active signature tab on the IME/IDM:
ScreenShot2 : Displays how to select a specific signature release:
Further using the filter option once we have obtained all the signatures from a particular release we can filter them based on engine, fidelity, severity etc.
By this we would be able to narrow down on the changes in signature release which can be potential cause for the issue based on which we can align our troubleshooting.
I am seeking WSA's SSL inspection throughput specification, but can't find on the datasheet.
I found the old data for S370/S670/S680 on https://www.cisco.com/c/en/us/products/collateral/security/cloud-web-security/datasheet-c78-737440.html...
hi,i have on hub - spoke ipsec tunnel.it is stable about 1 year.But suddenly one is down.the other tunnel are no issue.There is no changed in configuration also.when i debug the error,i got bellow message.Error: to get local certificate and ke...
Hi, aaa authentication for ssh/serial/console is set to tacacs and then localaaa authorization command set to tacacs and then localaaa authorization exec auth-server auto-enableaaa accounting enable/serial/ssh set to tacacs-server When logg...
Hello everyone,when you create a CSR for new certificate, you see it listed in ISE (Admin-System-Certificates-Certficate Management-Certificate Signing Requests). Later on, when you receive new cert, you bind it to the CSR pending in system. I have questi...