Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual page 438

Troubleshooting the 4200 Series Appliance
Make sure you have Produce Alert configured:
Step 3
sensor# configure terminal
sensor(config)# service signature-definition sig0
sensor(config-sig)# signatures 1300 0
sensor(config-sig-sig)# engine ?
normalizer
sensor(config-sig-sig)# engine normalizer
sensor(config-sig-sig-nor)# event-action produce-alert
sensor(config-sig-sig-nor)# show settings
normalizer
-----------------------------------------------
sensor#
Make sure the sensor is seeing packets:
Step 4
sensor# show interfaces FastEthernet0/1
MAC statistics from interface FastEthernet0/1
Media Type = backplane
Missed Packet Percentage = 0
Inline Mode = Unpaired
Pair Status = N/A
Link Status = Up
Link Speed = Auto_100
Link Duplex = Auto_Full
Total Packets Received = 267581
Total Bytes Received = 24886471
Total Multicast Packets Received = 0
Total Broadcast Packets Received = 0
Total Jumbo Packets Received = 0
Total Undersize Packets Received = 0
Total Receive Errors = 0
Total Receive FIFO Overruns = 0
Total Packets Transmitted = 57301
Total Bytes Transmitted = 3441000
Total Multicast Packets Transmitted = 0
Total Broadcast Packets Transmitted = 0
Total Jumbo Packets Transmitted = 0
Total Undersize Packets Transmitted = 0
Total Transmit Errors = 1
Total Transmit FIFO Overruns = 0
sensor#
Check for alerts:
Step 5
sensor# show statistics virtual-sensor
SigEvent Preliminary Stage Statistics
Number of Alerts received = 0
Number of Alerts Consumed by AlertInterval = 0
Number of Alerts Consumed by Event Count = 0
Number of FireOnce First Alerts = 0
Number of FireOnce Intermediate Alerts = 0
Number of Summary First Alerts
Number of Summary Intermediate Alerts
Number of Regular Summary Final Alerts
Number of Global Summary Final Alerts
Number of Alerts Output for further processing = 0alertDetails: Traffic Source: int0 ;
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
C-12
Signature engine
event-action: produce-alert default: produce-alert|deny-connection-inline
edit-default-sigs-only
-----------------------------------------------
= 0
= 0
= 0
= 0
Appendix C Troubleshooting
78-16527-01