cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
222
Views
0
Helpful
1
Replies

IDS 4210 - Interface duplex configuration

facundog
Level 1
Level 1

I have an IDS 4210 but It is not sending alerts to de CSPM. The comunication is "established" but I no have any alert regarding traffic signatures in the CSPM.

I believe that the problem could be the duplex configuration of the iprb0 interface.

Does anybody know how can I force the iprb0 to 10Mbps and half duplex??

1 Reply 1

gfullage
Cisco Employee
Cisco Employee

If the connection is showing as Established, then the problem is not the duplex setting. We don't recommend changing this, in fact I've never seen this cause a problem.

Try doing an "nrstop;nrstart" on the sensor to restart the services, do you see any Route Up/Down signatures appear? If not, then your CSPM database is probably corrupted, so go to the Troubleshooting Toolkit from the Start menu, and restore the database. Make sure you File - Export your cxonfiguration off first, then File-Import it back in after the restore is done.

If you do see Route UP/Downs but nothing else, then your sensor is probably not seeing any traffic. If you do a Snoop on the sniffing interface (snoop -d iprb0) do you see traffic? Is it all broadcast/multicast or is there unicast traffic? What level of alerts are you sending to CSPM (check under the Filtering tab in CSPM, set it to Medium).

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: