Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started.

New Member

Adding a 2nd sensor

My 2nd sensor is v2.2.1, do I need to upgrade to 2.5, then 3.0 or can I go directly to 3.0? Is there any documentation out there on this? Finally, do both sensors communicate (to the director)on the same port # or do I select one.If so, does anyone have a recommendation as to what port should the second sensor communicate on.

  • Other Security Subjects
3 REPLIES
Cisco Employee

Re: Adding a 2nd sensor

All sensor(s)/director communication is on the same port number. The default is 45000.

If you have only the 2.5 CD, you can use it to upgrade to 2.5, then download the 3.0 version from CCO and install it. Here are instructions for upgrading from 2.5 to 3.0:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids6/12216_02.htm#xtocid1115838

If you have the 3.0 CD, then you can use it to upgrade to 3.0 directly.

Also, once you're at 3.0, you can upgrade to 3.0(3) by downloading the 3.0(3) service pack from CCO and installing it.

New Member

Re: Adding a 2nd sensor

Used the 3.0 Cd and installed 2nd sensor, now both sensors don't work. The initial sensor quit sending alarms and when I try to look at current events nothing happens. Then I get route down on the postofficed deamon. Rebooted director, sensor1, then 2 then both then all. Still no communications between director and 1st sensor. BUT, I can ping the Ethernet port on the sensor from the director. You sure about connecting to the same port from both sensors?

Cisco Employee

Re: Adding a 2nd sensor

Hi Robert, sorry your setup is having trouble. Yes, I'm sure that you use the same port. All postoffice communication takes place via a single UDP port.

Make sure the following two files for each machine (sensors and unix director) reflect the port you're using. Do an nrstop and nrstart after any changes.

/usr/nr/etc/postofficed.conf:

Should have a token named PortNumberOfNetCommunications 45000

(replace 45000 with whatever port number you're using)

/usr/nr/etc/routes:

Make sure the port number is the same for each line.

Hope that helps. Let me know if not. wardwalk@cisco.com

88
Views
0
Helpful
3
Replies