Installation guide

E-22
Cisco Intrusion Prevention System Appliance Hardware Installation Guide for IPS 7.1
OL-24002-01
Appendix E Troubleshooting
Troubleshooting the Appliance
• The CSA MC event server allows up to ten open subscriptions by default. You can change this value.
You must have an administrative account and password to open subscriptions.
• CSA data is not virtualized; it is treated globally by the sensor.
• Host posture OS and IP addresses are integrated into passive OS fingerprinting storage. You can
view them as imported OS profiles.
• You cannot see the quarantined hosts.
• The sensor must recognize each CSA MC host X.509 certificate. You must add them as a trusted
host.
• You can configure a maximum of two external product devices.
For More Information
• For more information on working with OS maps and identifications, refer to Adding, Editing,
Deleting, and Moving Configured OS Maps and Adding, Editing, Deleting, and Moving Configured
OS Maps.
• For the procedure for adding trusted hosts, refer to Adding TLS Trusted Hosts.
External Product Interfaces Troubleshooting Tips
To troubleshoot external product interfaces, check the following:
• Make sure the interface is active by checking the output from the show statistics
external-product-interface command in the CLI, or choose Monitoring > Sensor Monitoring >
Support Information > Statistics in the IDM and check the Interface state line in the response, or
choose Configuration > sensor_name > Sensor Monitoring > Support Information > Statistics
in the IME, and check the Interface state line in the response.
• Make sure you have added the CSA MC IP address to the trusted hosts. If you forgot to add it, add
it, wait a few minutes and then check again.
• Confirm subscription login information by opening and closing a subscription on the CSA MC using
the browser.
• Check the Event Store for the CSA MC subscription errors.
For More Information
• For the procedure for adding trusted hosts, refer to Adding TLS Trusted Hosts.
• For the procedure for displaying events, refer to Displaying Events.
Troubleshooting the Appliance
This section contains information to troubleshoot the appliance. It contains the following topics:
• The Appliance and Jumbo Packet Frame Size, page E-23
• Hardware Bypass and Link Changes and Drops, page E-23
• Troubleshooting Loose Connections, page E-24
• Analysis Engine is Busy, page E-24
• Communication Problems, page E-25