Cisco IPS 7.1 Installation Guide download pdf (Page 312)

E-42

Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1

OL-24002-01

Appendix E Troubleshooting

Troubleshooting the Appliance

To initiate a manual block to a bogus host, follow these steps:

Step 1 Enter ARC general submode.

sensor# configure terminal

sensor(config)# service network-access

sensor(config-net)# general

Step 2 Start the manual block of the bogus host IP address.

sensor(config-net-gen)# block-hosts 10.16.0.0

Step 3 Exit general submode.

sensor(config-net-gen)# exit

sensor(config-net)# exit

Apply Changes:? [yes]:

Step 4 Press Enter to apply the changes or type no to discard them.

Step 5 Telnet to the router and verify that a deny entry for the blocked address exists in the router ACL. Refer

to the router documentation for the procedure.

Step 6 Remove the manual block by repeating Steps 1 through 4 except in Step 2 place no in front of the

command.

sensor(config-net-gen)# no block-hosts 10.16.0.0

Enabling SSH Connections to the Network Device

If you are using SSH-3DES as the communication protocol for the network device, you must make sure

you have enabled it on the device.

To enable SSH-3DES connections to the network device, follow these steps:

Step 1 Log in to the CLI.

Step 2 Enter configuration mode.

sensor# configure terminal

Step 3 Enable SSH-3DES.

sensor(config)# ssh-3des host blocking_device_ip_address

Step 4 Type yes when prompted to accept the device.

Blocking Not Occurring for a Signature

If blocking is not occurring for a specific signature, check that the event action is set to block the host.

To make sure blocking is occurring for a specific signature, follow these steps:

Step 1 Log in to the CLI.

Step 2 Enter signature definition submode.

sensor# configure terminal

1 ... 311 312 313 ... 422

No comments

Cisco IPS 7.1 Installation Guide Page 312