Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Adding IDS-SM to MARS

Hi All,


We have two cisco 6513 switches and four IDSSM, two in each switch. I have added the the IDSSM to MARS but i can't find the commands on the IDSSM to allow it to send all the logs to MARS. So, Could you please help me on knowing how to configure IDSSM to send all its logs to MARS?

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: Adding IDS-SM to MARS

No need to, if the IDSMs are properly configured in the CS-MARS, with the correct login and password, the CS-MARS will poll the IDSMs for events. Not the other way around.

Regards

Fredrik

4 REPLIES
Community Member

Re: Adding IDS-SM to MARS

No need to, if the IDSMs are properly configured in the CS-MARS, with the correct login and password, the CS-MARS will poll the IDSMs for events. Not the other way around.

Regards

Fredrik

Community Member

Re: Adding IDS-SM to MARS

Thanks Fredrik for your reply.

I have already added IDSSM to MARS with SSL access type (it's by default in MARS) and it's successfuly discovered by MARS but no logs or incidents are appeared in MARS, can you help me on knowing the reason?

Community Member

Re: Adding IDS-SM to MARS

Are you seeing any events in the IME? While you are tweaking it would be a good idea to enable one or two ICMP rules on the IDSMs or any other rule that would generate alot of alerts, just to have something to look at.

/Fredrik

Community Member

Re: Adding IDS-SM to MARS

Hi Fredrik,

There are alot of events on the IDSSM but these events aren't appeared on MARS although IDSSM is successfully discovered by MARS. That's also happened with Cisco NAC appliance which i added it to MARS but there are no incidents for it on MARS.

683
Views
0
Helpful
4
Replies
CreatePlease to create content