Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Can't get alarm forwarding to work on 2.3.2i/3.0(1)s7

I'm trying to get a 4210 sensor running 3.0(1)s7 to send alarms to the CSPM box that manages it and another CSPM box. I want to see the same alarm in the event viewer on the CSPM box that DOESN'T manage it.

Does this feature work in the releases I'm running? Both CSPM boxes are setup as stand-alone systems. Also, on the Additional Destinations tab which is on the Advanced tab for the sensor you're trying to configure, there is additional wording that says "These destinations must be configured properly to receive the alarms, this panel will not configure the destinations." What must be done on the CSPM box that is considered the second destination?

Thanks in advance for your help.

1 REPLY
Cisco Employee

Re: Can't get alarm forwarding to work on 2.3.2i/3.0(1)s7

With CSPM 2.3.2i I believe that CSPM can be configured to receive alarms from other boxes which they are not configuring.

So on the CSPM box configuring the sensor you would add the second CSPM box as an additional destination.

On the CSPM box that receives the alarms (but does not configure the sensor) you would add the sensor as a PostOffice host form which the CSPM box would be receiving alarms:

Here are a few links to the documentation that may help in configuring this feature. I have not configured this feature myself.

http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/rn231i.htm#xtocid283763

Secion: New Host Type: Postoffice Forward/Receive

http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch04.htm#205546

Section: Configuring CSPM to Forward postoffice-Based Audit Events to a Third-Party Client

If after reading through these sections you still have problems then feel to respond, and I can try to get one of the CSPM developers to answer your questions.

79
Views
0
Helpful
1
Replies