10-8
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter10 Co nfiguring Global Correlation
Understanding Global Correlation Sensor Health Metrics
•
For information about configuring an HTTP proxy or DNS server to support global correlation , see
Configuring the DNS and Proxy Servers for Global Correlation and Au tomatic Update, page 3-10.
Understanding Global Correlation Sensor Health Metrics
For global correlation, the following metrics are added to sensor health monitoring:
•
Green indicates that the last update was successful.
•
Yellow indicates that there has not been a successful update within the past day (86,400 seconds).
•
Red indicates that there has not been a successful update within the last three days (259,200
seconds).
For network participation, the following metrics are added to sensor health monitoring:
•
Green indicates that the last connection was successful.
•
Yellow indicates that less than 6 connections failed in a row.
•
Red indicates that more than 6 connections failed in a row.
Use the health-monitor command in service submode to configure the health statistics for the sensor.
Use the show health command to see the results of the health-monitor command.
Global correlation health status defaults to red and changes to green after a successful global correlation
update. Successful global correlation updates require a DNS se rver or an HTTP proxy server. If the
sensor is deployed in an environment where a DNS or HTTP proxy server is not available, you can
address the red global correlation health and overall sensor health s tatus by disabling global correlation
and configuring sensor health status not to include global correlation he alth status.
For More Information
•
For more information about the sensor health metrics and how to enable/disable Global Correlation
health status, see Configuring Health Status Information, page 17-13.
•
For the procedure to view sensor health metrics, see Showing Sensor Overall Health Status,
page 17-17.
•
For information about configuring an HTTP proxy or DNS server to support global correlation , see
Configuring the DNS and Proxy Servers for Global Correlation and Au tomatic Update, page 3-10.
•
For the procedure to disable global correlation, see Configuring Global Correlation Inspection and
Reputation Filtering, page 10-10.
Configuring Global Correlation Inspection and Reputation Filtering
This section describes global correlation inspection and reputation filtering, and how to configure them.
It contains the following topics:
•
Understanding Global Correlation Inspection and Reputation Filtering, page 10-9
•
Configuring Global Correlation Inspection and Reputation Filtering, page 10-10