IPS-4260 Traps

Question

We would like to be able to generate a trap or some how determine if/when our IPS-4260 sensor goes into bypass mode. In addition, we'd like to be able to monitor the CPU, memory, and interface status.. It would appear the 4260 has limited monitoring capabilities.
Based on the IPS release notes, I have loaded the Cisco-CIDS-MIB, Cisco-PROCESS-MIB, Cisco-ENHANCED-MEMPOOL-MIB, and Cisco-ENTITY-ALARM-MIB into WhatsUp Gold v14.3. However, uncertain what to check for. I can see traps showing up; however, they are not descriptive enough to tell what is what.
How do we trap/monitor for bypass mode? Anyone else have traps/monitoring operational on their 4260?
Thanks.

Answer 1

After some research, finally was able to get the sensor traps to work properly.
I had to ensure the sensor was actually sending traps.
Once configured using:
service notification
error-filter warning|error|fatal
enable-detail-traps true
enable-notifications true
trap-destinations
trap-community-name
trap-port 162
I confirmed traps were being sent off the sensor using a tcpdump:
# tcpdump -ni ma0_0 udp and port 162
I also confirmed traps were being obtained on the monitor application - in my case WhatsUp Gold (system trap logs)
The strings you want to search for in your monitor application are:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
%PassiveMonitor.Payload.Protocol Version=SNMPv2 %PassiveMonitor.Payload.1.3.6.1.4.1.9.9.383.1.3.3=Inline data bypass has started.
(this one means the IPS sensor is presently in bypass mode and NOT checking traffic)
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
%PassiveMonitor.Payload.Protocol Version=SNMPv2 %PassiveMonitor.Payload.1.3.6.1.4.1.9.9.383.1.3.3=Inline data bypass has stopped.
(this means the IPS sensor is no longer in bypass mode)
In order to make it work, I had to ignore the major and minor event numbers and match on the respective strings only (Inline data bypass ...)
Another message that might be of interest, just prior to stopping the inspection generated is:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
%PassiveMonitor.Payload.Protocol Version=SNMPv2 %PassiveMonitor.Payload.1.3.6.1.4.1.9.9.383.1.3.3=Bypass Mode has been enabled, stopping packet inspection.
IPS version 7.1 is supposed to be released towards end of the year with additional trap/snmp support (according to Cisco). The above is working on version 6.2.
As mentioned in release notes, the following MIBS are the only ones supported:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
-CISCO-CIDS-MIB
-CISCO-PROCESS-MIB
-CISCO-ENHANCED-MEMPOOL-MIB
-CISCO-ENTITY-ALARM-MIB
I'm hoping this information might assist someone else.