Troubleshooting Radius Authentication; Troubleshooting External Product Interfaces; External Product Interfaces Issues - Cisco IPS 7.1 Installation Manual

Appendix E Troubleshooting
Step 6 If the Analysis Engine still reads
command output.

Troubleshooting RADIUS Authentication

Symptom
Conditions
least once after RADIUS authentication is enabled or after the sensor is reset or rebooted.
Workaround
enforced for that RADIUS user.
For More Information
For detailed information on RADIUS authentication, refer to
Parameters.

Troubleshooting External Product Interfaces

This section lists issues that can occur with external product interfaces and provides troubleshooting tips.
For more information on external product interfaces, refer to
This section contains the following topics:
•
•

External Product Interfaces Issues

When the external product interface receives host posture and quarantine events, the following issues
can arise:
•
•
•
•
OL-24002-01
Attempt limit configured on the IPS sensor may not be enforced for a RADIUS user.
Applicable for RADIUS users only. The RADIUS user must have logged in to the sensor at
Log in to the sensor with the correct credentials and from that time on the attempt limit is
External Product Interfaces Issues, page E-21
External Product Interfaces Troubleshooting Tips, page E-22
The sensor can store only a certain number of host records:
If the number of records exceeds 10,000, subsequent records are dropped.
–
If the 10,000 limit is reached and then it drops to below 9900, new records are no longer
–
dropped.
Hosts can change an IP address or appear to use another host IP address, for example, because of
DHCP lease expiration or movement in a wireless network. In the case of an IP address conflict, the
sensor presumes the most recent host posture event to be the most accurate.
A network can include overlapping IP address ranges in different VLANs, but host postures do not
include VLAN ID information. You can configure the sensor to ignore specified address ranges.
A host can be unreachable from the CSA MC because it is behind a firewall. You can exclude
unreachable hosts.
Cisco Intrusion Prevention System Appliance and Module Installation Guide for IPS 7.1
, contact TAC with the original show tech support
Not Running
Troubleshooting RADIUS Authentication
Configuring Authentication and User
Configuring External Product Interfaces.
E-21