E-32
Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1
OL-24002-01
Appendix E Troubleshooting
Troubleshooting the Appliance
Step 4 Verify the interface configuration:
• Make sure you have the interfaces configured properly.
• Verify the SPAN and VACL capture port configuration on the Cisco switch.
Refer to your switch documentation for the procedure.
Step 5 Verify again that the interfaces are up and that the packet count is increasing.
sensor# show interfaces
For More Information
• For the procedure for properly installing the sensing interface on your sensor, refer to the chapter on
your appliance in this document.
• For the procedures for configuring interfaces on your sensor, refer to Configuring Interfaces.
Unable to See Alerts
If you are not seeing alerts, try the following:
• Make sure the signature is enabled
• Make sure the signature is not retired
• Make sure that you have Produce Alert configured as an action
Note If you choose Produce Alert, but come back later and add another event action and do not
add Produce Alert to the new configuration, alerts are not sent to the Event Store. Every time
you configure a signature, the new configuration overwrites the old one, so make sure you
have configured all the event actions you want for each signature.
• Make sure the sensor is seeing packets
• Make sure that alerts are being generated
• Make sure the sensing interface is in a virtual sensor
To make sure you can see alerts, follow these steps:
Step 1 Log in to the CLI.
Step 2 Make sure the signature is enabled.
sensor# configure terminal
sensor(config)# service signature-definition sig0
sensor(config-sig)# signatures 1300 0
sensor(config-sig-sig)# status
sensor(config-sig-sig-sta)# show settings
status
-----------------------------------------------
enabled: true <defaulted>
retired: false <defaulted>
-----------------------------------------------
sensor(config-sig-sig-sta)#
Step 3 Make sure you have Produce Alert configured.
sensor# configure terminal
Comments to this Manuals