Troubleshooting Global Correlation Critical

[Mark Ewing]

     

Table of Contents

Most Common Issues        How GC Works        Add a DNS Server        Verify GC Traffic

 

     Most Common Issues

   
     
1. No DNS server is configured/reachable
    
2. Firewall/Proxy Server/Traffic Shaper is blocking the GC traffic
         
   
    

    How GC Works

    The sensor performs the following steps       
       
1. Resolve the ironport domain name in the GC url (UDP port 53)
      
2. Connect to the ironport server via https (TCP port 443)
              -            Retreive the ip address of the GC  server with the latest update
      
3. Connect to the GC  server and retreive the update via HTTP (TCP port 80)
       

Add a DNS Server

   
     
1. Via the GUI
          Go to Configuration => Sensor Setup => Network and add a DNS entry
    
2. Via the CLI
            Enter the command        
            setup
            proceed through the setup process until it asks about DNS servers and enter
            yes
            then        enter your DNS servers      
         
   
    

Verify GC Connectivity

    GC updates every 5 minutes, so we can do the following command to do a tcpdump to the screen, and see where the GC update process is breaking down:
    
   packet display <management interface> expression not host <management host>
  
   Where the management host includes all hosts connecting to the sensor via IDM, IME, MARS, or the CLI. The traffic we expect to see is described in How GC Works