02-15-2008 11:04 AM - edited 03-09-2019 08:07 PM
I am working on a MARS appliance and have devices reporting to it. I also have an ASA with the AIP-SSM installed. I have added the ASA and AIP to MARS and from MARS I can SSH to the AIP module. But If I run a report I do not see anything coming from teh AIP module. I can SSH to the SIP from MARS and run the "show events" and I see events. Any ideas on why I will not be seeing those events in MARS? The AIP is running 6.0.3 S315, MARS is running 4.3.2(2627) S315. Thank you, James
02-19-2008 10:26 AM
Make sure the AIP is configured to send events to the MARS IP.
02-19-2008 02:59 PM
Not sure if this had anything to do with it but for some reason someone had configured the AIP-SSM to send SNMP traps to MARS. I removed that and the next day I was able to see events in MARS from the AIP-SSM.
02-20-2008 03:48 PM
I have a similar issue as well. SNMP is not configured at all though on the AIP. Do i need to configure anyhting else on the Semsor - like define CS-MARS as a external product on it or anything.
02-21-2008 05:32 AM
In order to get events in MARS for any Cisco IDS/IPS sensor you will need to create a "Viewer" account on the sensor for MARS to login and grab them. You will also need to configure MARS to be able to SSH to the sensor as well. To test the SSH you can SSH to MARS and then SSH out to the sensor.
ssh "username"@"ip_address_sensor"
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide