CISCO IPS 4270 rebooting again and again

Dear Experts,
We are facing problem where Cisco IPS 4270 is keep rebooting, attached are the logs.
after entering username and password it again goes into restart cycle
Appreciate your help
Muhammad Nasim

You should try reimageing you sensor. If that doesn't;t fix this issue, you need to RMA the unit to Cisco.
Cisco might just let you RMA the unit as is if you have a contract, but bringing it is faster.
- Bob

Similar Messages

Cisco ips 4270 cpu 100% utilization...

hi folks i have cisco ips 4270 version 7.0(2) E3 when i try to access it through IDM its show the cpu utilization of cpu1=100% and cpu4=100% but cpu1 and cpu2 are varying can any one please tell me what will be the solution of this problem...
when i try to go to the configuration then its give me the attached error..........document attached please check....

Hi,
Having 100% on some of your CPU is normal on the IPS platform.
The device is using it's idle cycles to prepare for the handling of the incoming packets and to reduce the delay it will introduce on their path so it is expected to get this even when under low load.
If you want to have a better idea of the capacity % of your IPS you are currently using, you should have a look at the Inspection Load value. Looking at the data you provided, you are around 25% at the moment.
For the rdep timeout message, it seems to be a software issue. Looking closer at the picture you attached, we also see "Analysis Engine Status: Not Responding".
It is a bit difficult to troubleshoot those on CSC so I would advise you to open a TAC case if you want to know the exact root cause.
What I would advise is to upgrade to the latest 7(0) code which is I believe 7.0(5a)E4 since the issue is most then likely fixed in this version.
If you are looking for a quick fix, a reboot of the IPS should clear this but the problem will most then likely come back later.
Regards,
Nicolas

Cisco ips 4270 unequal cpu utilization

I am having 2 cisco IPS 4270 devices with an IOS version 7.0(2)E4. When monitoring through IPS manager, I am able to see 4 CPU's.
In CPU 1 the utilzation is showing near to 100 percent. CPU 2 is showing zero or very less utilsation. CPU 3 & CPU 4 are showing average utilization - nearly equal to 40 percent.
I doubt why i am getting zero percent CPU utilization in CPU 2 and 100 percent utilisation in CPU 1?
whether we can do a distribution of CPU among the four CPU's.?
Hey cisco folks, please help.

This was mentioned in a previous post, specifically the reply by Scott Fringer. Post here:
https://supportforums.cisco.com/message/3065777#3065777
In Scott's post, he quoted the E3 engine release notes regarding CPU utilization (highlighting mine):
The E3 signature engine update contains changes from CSCsu77935
The resolution of this defect modified the idle time algorithm of the sensor by applying additional CPU to polling of the NICs to decrease the polling interval and reduce latency. This results in the CPU usage being reported higher than in previous releases, including using external tools such as top and ps.
You can notice this additional CPU load on single-CPU platforms, as well as the primary CPU of multi-core systems. Since the additional CPU load that is reported while polling is actually available to process packets, and reduces as inspection load goes up, it does not negatively affect the overall throughput of the IPS.
So, what you are seeing should be considered normal, and doesn't need correction. That is, unless you are seeing packet loss.

IPS 4270 with 6509 VSS in Promiscous mode

Dear all,
I am trying to figure out how to configure 2x IPS 4270 in promiscous mode with Cisco 6509 VSS:
I have attached the LLD core datacenter design including the IPS physical placement in my network.
The following points are my concerns in this design:
Shall I connect each of the IPS 4270's into VSS Chassis A and B, or I keep each IPS connected to different Chassis? (considering the SPAN port configuration on VSS and if I could encounted Asymmetric routing issue or not).
Can I use Etherchannel in either case (keep in mind it's promiscous mode), that means the destination interface on the VSS will be an Etherchannel interface, but does the Cisco IPS 4270 support Etherchannel while in promiscous mode?
I really appreciate your input on this matter guys.
Cheers
Mohammed Khair

Hi,
1.You can Connect the each IPS into Chasis A and B That is Not aproblem .But While Configuring the RSPAN Monitor From A to B and B to A should monitor the both vlans ( i mean RSAPN A and B also vice versa in your config then it will give both out put even connectivity between IPs and chasisi one fails also)
2.IPS Supports the Etherchannel while in promiscous mode as well.

Cisco IPS make slow copy between linux server

we have 3 subnet A, B, C . Each subnet have some linux servers. Subnet C is protected by cisco IPS 4270.
1)If we config IPS to bypass traffice, copy speed between servers around 10MB/s -> 25MB/s.
2) IF IPS protect subnetC.
When we copy file from a serrver of SubnetC to subnet A or B, copy speed increase from min to around 20MB/s.
And when we copy file from a serrver of SubnetA or B to subnet C, copy speed very slow around 700kB/s-> 2MB/s
The server used command "scp .... "
So we think there are signatures we should tuning. we have CSM but we havent seen any relate events about this problem.
Help me check this problem!

Hello,
You can do what Jon mentioned, you might see a signature being triggered when Host C takes place but if by any chance you do not then create captures for both traffic flows (With C and Without C).
Afterwards compare
You might find some weird in that TCP session that involes C (packet loss, then retransmissions, ooo packets, etc).
Make sure you correlate all of the information
Rate all of the helpful posts!!!
Regards,
Jcarvaja
Follow me on http://laguiadelnetworking.com

IPS 4270 placement @ Internet Edge

Given that I have same topology as shown in Internet Edge Cisco IPS Design Best Practices and basically inserting 4270 Appliance into an INLINE mode.
Core and Distribution Switch = Layer-3 routed links
Distribution Switch and ASA = Layer-2 access port
I'm wondering how IPS sensors be configured? I think I understand belows method but since my Core/Distrib is a layer-3 links, not sure which method gonna work since most require two vlans ...
1. Interface Pairing
2. VLAN Pairing
3. VLAN Group
Anyone has same experience?
Thanks in advance ...
Gerard

I have a 4270-20 positioned at the edge of my network. It sits between the outside of the firewall and our Internet router. The only problem with this model is that it makes tracking down threats very difficult, as the only thing you will ever see are the NAT'd public IPs for all your traffic.
To get around this limitation, we created an addition interface in promiscuous mode and we SPAN the traffic on the link between our core switch and the internal interface of our firewall to it. This gives us complete outside protection and inside visibility. This is still not an ideal setup and we are in the process of re-architechting our internal traffic so that we can run two in-line pairs on the IPS. One internal, and one external.
The best way to go, is having the IPS in the firewall itself, but throughput on firewalls is often a concern, and unfortunately for Cisco, quite a limitation.

My iPod wont turn on anymore. I have had my iPod since the end of January of 2012, Last night it shut off on me. It keeps trying to reboot itself, but all it does it show the apple symbol, then the screen goes white and reboots again. I need help. :(

Hi, My name is Cassie.
I bought my iPod off of amazon just around the end of January of this year (2012). Last night I was playing around on my iPod. Listening to pandora, and editing pictures. I got to a picture and clicked edit, and then my iPod shut off. It rebooted itself and seemed to be running as if nothing had happened. I put my music back on and went back to the picture and tried to edit it again. I clicked the edit button and the ipod shut off again. This time, it kept rebooting. It went to the apple symbol to turn on and about thirty seconds, the time it normally takes to turn on, the whole screen went white and then shut off and tried rebooting again. It kept doing this over and over again. After a while, it did eventually stop, but only to a completely white screen. It was like that all night long because I fell asleep. (gave up on it). It is now the afternoon and after I held the lock button and the home button down the screen when off. I let it sit for about a half an hour, then I tried turning it on again. But it still is doing the same thing. I have no idea what I could have done to make it do this. Unfortunalty, I am not home to connect it to my own iTunes, but regaurdless, it wont even connect to the computer. I did have my ipod plugged in the whole time it was rebooting and shutting off last night. It was connected to my wall jack which normally works fine. But even having it plugged into the computer as it is now, its still doing the same thing. I am dissapointed that I might end up loosing everything that I have on it. I have not been able to sync it to my computer to save all the apps and pictures and music I have stored on it. I really do hope I can get some help or advice!
Thank You!!
-Cassie Lawrence

Reset the PRAM
Reinstall the operating system from the dvd (you will not loose your data)

I DOWNLOADED FIREFOX 10 ON MY WINDOWS 7 COMPUTER I REBOOTED AS TOLD BUT WHEN I TRY TO OPEN FIREFOX IT SAYS IT HAS TO BE REBOOTED; WHEN I TRY TO UNINSTALL IT SAYS IT HAS TO BE REBOOTED OVER AND OVER AGAIN in English

I DOWNLOADED FIREFOX 10 ON MY WINDOWS 7 COMPUTER I REBOOTED AS TOLD BUT WHEN I TRY TO OPEN FIREFOX IT SAYS IT HAS TO BE REBOOTED; WHEN I TRY TO UNINSTALL IT SAYS IT HAS TO BE REBOOTED OVER AND OVER AGAIN in English

Exactly what did you do to "try to transfer all of yoru photos" to the iMac?
LN

My ipad mini keeps rebooting over and over again, even after a total reset. what to do?

Hello people,
I have my ipad mini since christmas 2012 and it was working like a charm.
But a few weeks ago it rebooted out of nowhere, and now it reboots like every 5 minutes average.
Sometimes it wont boot up properly and boot 3 times in a row, i sometimes even have to force it to reboot by holding the home+lock button.
I reset my ipad and then restored from a back up but it didn't stop.
Today I reset mty ipad again without restoring from anything, just blanc, like out of the box, installed facebook and youtube app and a few minutes later it rebooted again.
I think i've tried anything but maybe you can help me.
Bye from Holland

here is my ipad as it looks right now....
it crashed on me like before and it roebooted a couple times, i watched tv for like an hour.
now im back i see that my ipad gave a blue screen :'(
i had to share this with you guys and the rest of the communitity
i think i dont have to wait for ios7 -_-
lets head to the Dixons in the next couple of days....
To be continiued....

Cisco IPS Concurrent session support in ips 4260 and 4270 sensor

I am wondring that no document from Cisco IPS data sheets mention the concurrent session support in Cisco IPS 4200 series sensor. I am looking forward to any one who can advise about the subject.
Thanks
Nouman

Hi.
with IPS devices it's difficult to measure performance by # of connections per second since several factors count to the performance limit, including:
1- packet size.
2- object sizes per transaction
3- transactions per second
4- signatures enabled
5- features enabled
that why public documents try to make it more realistic by mentioning the transactional performance.
here is a link mentioning concurrent connections for 4270:
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd806e7283.html
although the link mentiones 100k and 200k, but we've seen situations where we had a lot more connections with a smaller amount of signatures enabled.
for the 4260 the public document only mentions the transactional performance.
Regards,
Fadi.
If this answers your question please mark the thread as resolved.

TS1398 My iPhone won't stay connected to my wireless. I have to keep repowering my phone and then it lasts for a few minutes until I have to reboot again. Any ideas? Anyone experienced the same?

My iPhone won't stay connected to my wireless. I have to keep repowering my phone and then it lasts for a few minutes until I have to reboot again. Any ideas? Anyone experienced the same?

HI:
It does not sound like a battery problem.
Try a couple of things:
1. Reset the SMC
http://support.apple.com/kb/HT3964
2. Reset (if you can) the PRAM
http://support.apple.com/kb/PH4405
If that does not help, delete the mouse in system preferences, turn it off, restart, and turn the mouse back on.
Barry
P.S. I only needed it once, but I have an old USB mouse in case my Bluetooth one decides to quit.

Have the same problem tried the signing in and out, rebooting, uninstalling and back again nothing is working, on 4th download of creative cloud still coming up with lightroom 5 after signing in anf out, also signing out dowloading and signing in, spent 2

have the same problem tried the signing in and out, rebooting, uninstalling and back again nothing is working, on 4th download of creative cloud still coming up with lightroom 5 after signing in anf out, also signing out dowloading and signing in, spent 2 days on this, just cannot spend days on trying tricks and hacks

I am getting so mad because I cant even sign out OR quit! They are both grayed out. I have the spinning blue wheel in my apps and am trying to fix that but none of the solutions are working.

My Ipad reboots over and over again could someone help with my problem?

My Ipad reboots over and over again, could someone help with my problem?

Try a reset. Hold the Sleep and Home button down for about 10 seconds until you see the Apple logo.

CS-MARS 4.3.1 and Cisco IPS 5.1(6)

Hello everyone,
I start this discussion as I think I'm experiencing something really strange with CS-MARS 4.3.1 (build 2600) and Cisco IPS 5.1(6).
I upgraded today our MARS box from 4.2.8 to 4.3.1. And a bit later, I decided to migrate one of our IPS from 4.1 to 5.1.
After all the upgrades, I deleted the old IDS 4.1 from MARS and recreated it. But I can't have MARS to communicate with the IPS! From the MARS box I can "telnet ... 443", I have a response, but MARS complains again and again of being not able to contact the IPS. "Try a telnet ... 443 from the MARS appliance to check if IP connectivity is present" is the message reported by the "View Error" after a "test connectivity" has been issued.
The problem is that I need that first connection to make MARS subscribes to the IPS in order to receive the logs.
I made a try with a 5.1 IPS already present before the upgrade : same result "Can't connect". But as the MARS box subscribed previously to the IPS, the logs are arriving.
Does someone else have this strange behaviour ?
Regards,
Jean-Fran?ois Gobin

hello,
When I upgrade the mars to 4.3.1. I've noticed that the mars doesn't received any logs from IPS,ASA and other reporting device. But when I check ASA and IPS, i'm pretty sure that the ASA and IPS were sending syslogs alerts to mars the only problem is the mars could not receive. I can ping the IPS / ASA in the mars console but failed when i test the connectivity/discover in Web Interface.
I also execute the pnstart and pnstatus command in the CLI console.
This is what i get:
[pnadmin]$ pnstart
[pnadmin]$ pnstatus
Configuration error: host name does not match janus.conf::janusBoxName.
Please contact Cisco for support.
[pnadmin]$
Any ideas about this?...
Carlou

Can not find my Program in Lion Activity Monitor until reboot again

Hi,
I have tried to installed the datacard driver and user interface program in Lion and reboot; however, the resident program to detect the device of datacard does not exist in Activity Monitor. I need to reboot again, then I can find it exits in Activity Monitor of Lion. This issue does not happen in Mac Snow/Snow Leopard(32-bit/64-bit). I use the Metapackage or terminal command line to install and both need to reboot one more time. My script is
sudo defaults write /Library/Preferences/loginwindow AutoLaunchedApplicationDictionary -array-add '{"Path" = "/opt/data/Monitor.app";"Hide" = "0";}'
Is it a side effect of finder known issue in Lion ? Or I need to use another way like "Launch Daemon" or "Launch Agent" to do?
Many thanks for your comment.
Jason

I suspect it's Photoshop Express, the Adobe Touch App from the App Store
http://www.photoshop.com/tools/expresseditor
http://itunes.apple.com/us/app/adobe-photoshop-express/id331975235?mt=8&ls=1
Express forum
http://forums.adobe.com/community/psexpress

CISCO IPS 4270 rebooting again and again

Similar Messages

Maybe you are looking for