IDS & Cisco Works SIMS

Question

Hello,
I try to integrate a IDS 4.1 appliance to Cisco Works SIMS 3.1 (Netforensics) . But I fail for 2 days now. I can see that the CSIDS4 agent tries to connect to the IDS sensor with TCP port 443 but in the logs I always can see a "failed to conntect host".
I configured the "NF CSIDS Agent":
"Date Processor Data1" -> "CSIDS4 AGENT PROTOCOL" -> "MODE = SECURE"
There is a field: "signature"
Do I need fill out that field? What is the correct input for that field?
Or ist "mode" secure the wrong mode?
Has anybody integrated a Cisco IDS 4.1 to NetForensics 3.1 successfully?
PLEASE HELP!
Thanks a lot
Markus

Answer 1

Hello,
On the IDS Sensor I found that error events:
evError: eventId=1050261859615885102 severity=error
originator:
hostId: idssensorgraz01
appName: cidwebserver
appInstanceId: 11821
time: 2004/10/18 07:28:23 2004/10/18 09:28:23
errorMessage: name=errUnclassified srvcReq protoErr: unexpected_message [10,0]
2. evError: eventId=1050261859615885103 severity=error
originator:
hostId: idssensorgraz01
appName: cidwebserver
appInstanceId: 1153
time: 2004/10/18 07:28:23 2004/10/18 09:28:23
errorMessage: name=errTransport WebSession::sessionTask(4) TLS connection exception: handshake incomplete.
Maybe that helps?
Markus