IPS 4260-70 Events to Saalt - RSA using PORT 443

Unanswered Question
Oct 19th, 2010
User Badges:

I have a request to send all IPS 4260-70 on os vs 7.0.4(e4)  Events to Saalt - RSA using PORT 443.  I created an admin account, how do you configure the port 443?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Scott Fringer Tue, 10/19/2010 - 12:29
User Badges:
  • Cisco Employee,

Edwin;


  Cisco's IPS sensors do not send events by default; they make use of the Security Device Event Exchange (SDEE) protocol in a client-server implementation (the IPS being the server and the remote application being the client).  By default, the IPS will listen on TCP port 443 for SDEE connections requesting events or opening a SDEE subscription.  The remote application (Saalt?) should require configuring the IP address of the IPS and a username/password for logging into the IPS.  The IPS will need an access list entry for the remote application host to allow successful communication.


Scott

Actions

This Discussion