Cisco IPS 7.1 Installationsanleitung PDF herunterladen (Seite 321)

E-51

Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1

OL-24002-01

Appendix E Troubleshooting

Troubleshooting the Appliance

Caution The syslog is much slower than logApp (about 50 messages per second as opposed to 1000 or so). We

recommend that you enable debug severity on one zone at a time.

TCP Reset Not Occurring for a Signature

If you do not have the event action set to reset, the TCP reset does not occur for a specific signature.

Note TCP Resets are not supported over MPLS links or the following tunnels: GRE, IPv4 in IPv4, IPv6 in

IPv4, or IPv4 in IPv6.

To troubleshoot a reset not occurring for a specific signature, follow these steps:

Step 1 Log in to the CLI.

Step 2 Make sure the event action is set to TCP reset.

sensor# configure terminal

sensor(config)# service signature-definition sig0

sensor(config-sig)# signatures 1000 0

sensor(config-sig-sig)# engine atomic-ip

sensor(config-sig-sig-ato)# event-action reset-tcp-connection|produc-alert

sensor(config-sig-sig-ato)# show settings

atomic-ip

-----------------------------------------------

event-action: produce-alert|reset-tcp-connection default: produce-alert

fragment-status: any <defaulted>

specify-l4-protocol

-----------------------------------------------

specify-ip-payload-length

-----------------------------------------------

specify-ip-header-length

-----------------------------------------------

specify-ip-tos

-----------------------------------------------

--MORE--

Step 3 Exit signature definition submode.

sensor(config-sig-sig-ato)# exit

sensor(config-sig-sig)# exit

sensor(config-sig)# exit

Apply Changes:?[yes]:

Step 4 Press Enter to apply the changes or type no to discard them.

1 2 ... 316 317 318 319 320 321 322 323 324 325 326 ... 421 422

Keine Kommentare

Cisco IPS 7.1 Installationsanleitung Seite 321