E-37
Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1
OL-24002-01
Appendix E Troubleshooting
Troubleshooting the Appliance
For More Information
• For the procedure to verify that ARC is running, see Verifying ARC is Running, page E-37.
• For the procedure to verify that ARC is connecting, see Verifying ARC Connections are Active,
page E-38.
• For the procedure to verify that the Event Action is set to Block Host, see Blocking Not Occurring
for a Signature, page E-42.
• For the procedure to verify that the master blocking sensor is properly configured, see Verifying the
Master Blocking Sensor Configuration, page E-43.
• For a discussion of ARC architecture, refer to Attack Response Controller.
Verifying ARC is Running
Note The CLI output is an example of what your configuration may look like. It will not match exactly due to
the optional setup choices, sensor model, and IPS 7.1 version you have installed.
To verify that the ARC is running, use the show version command. If the MainApp is not running, the
ARC cannot run. The ARC is part of the MainApp.
To verify that the ARC is running, follow these steps:
Step 1 Log in to the CLI.
Step 2 Verify that the MainApp is running.
sensor# show version
Application Partition:
Cisco Intrusion Prevention System, Version 7.1(3)E4
Host:
Realm Keys key1.0
Signature Definition:
Signature Update S605.0 2011-10-25
OS Version: 2.6.29.1
Platform: ASA5585-SSP-IPS10
Serial Number: 123456789AB
No license present
Sensor up-time is 13 days.
Using 4395M out of 5839M bytes of available memory (75% usage)
system is using 26.2M out of 160.0M bytes of available disk space (16% usage)
application-data is using 69.7M out of 171.6M bytes of available disk space (43%
usage)
boot is using 57.3M out of 70.5M bytes of available disk space (86% usage)
application-log is using 494.0M out of 513.0M bytes of available disk space (96%
usage)
MainApp S-2011_NOV_16_00_20_7_1_3_46 (Release) 2011-11-16T00:23:0
6-0600 Running
AnalysisEngine S-2011_NOV_16_00_20_7_1_3_46 (Release) 2011-11-16T00:23:0
6-0600 Running
CollaborationApp S-2011_NOV_16_00_20_7_1_3_46 (Release) 2011-11-16T00:23:0
6-0600 Running
CLI S-2011_NOV_16_00_20_7_1_3_46 (Release) 2011-11-16T00:23:0
6-0600
Comments to this Manuals