Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Sensor contains duplicate SigEvent Action Filters

Everytime I re-import sensors into IPS MC and to later attempt to generate sensor configuration, they always fail with the following sensor error(s):

"The configuration of Sensor contains duplicate SigEvent Action Filters.This was probably caused by defining the filter at the group or global level. Remove the filter at the device level and retry the generate operation."

Although, all my SigEvent Action Filters are defined/applied at the global level, it seems the only way to be successful is to always remove all filters at the device(s) before re-importing and then everything seems to work when I try to generate new sensor configuration.

This doesn't seem normal to me. Can anyone shed some light?

1 REPLY
Silver

Re: Sensor contains duplicate SigEvent Action Filters

This can happen if the inherited filters for the device being generated contains duplictes, that is, the filter at the group level equal to a filter at device or global level.

Delete the duplicate filter, save and generate again.

126
Views
0
Helpful
1
Replies
CreatePlease to create content