MARS (4.3) can't add IPS (6.0)

[balsheikh]

Hi All,

I'm trying to add IPS running version 6.0 to MARS running version 4.3 but with no success.

I'm getting the error message below:

***Error connecting to device.

Make sure MARS have access to the ids device on port <443>

Try using "telnet 172.20.1.12 443" on MARS CLI to check if the traffic is permitted.***

I had check the ACL on the IPS to permit access for MARS and added the MARS as trusted TLS IP-host as well but still getting the same error.

Kindly advice !!

Regards,

Belal

[jim]

I got the same message when I upgraded. Though it still seems to be working even though the test connection failed.

[balsheikh]

eventually we are hitting the following bug:

CSCsk03722 -Test Connectivity returning error.

Although you are getting an error on the test connectivity, the IPS sensor is still reachable via telnet and Mars can receive its events. ?

Regards,

[michaelwoolfe]

Reference this posting:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40.1ddfee2e/2#selected_message

A lot of people are having the same issue. I recommend running a real-time query on the reporting device to see if you are recieving events.

[balsheikh]

Hi there,

you are absolutely true..

Actually I enabled the Sig ID 2000 & 2004 for ICMP request and Reply accordingly on IPS for testing purpose and I did a ping and amazingly I managed to get the reports on the MARS.