Filter
Top Products
C-38
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix C Troubleshooting
Troubleshooting the Appliance
Blocking
This section provides troubleshooting help for blocking and the ARC service. It contains the following
topics.
• Troubleshooting Blocking, page C-38
• Verifying the ARC is Running, page C-39
• Verifying ARC Connections are Active, page C-40
• Device Access Issues, page C-41
• Verifying the Interfaces and Directions on the Network Device, page C-43
• Enabling SSH Connections to the Network Device, page C-44
• Blocking Not Occurring for a Signature, page C-44
• Verifying the Master Blocking Sensor Configuration, page C-45
Troubleshooting Blocking
After you have configured the ARC, you can verify if it is running properly by using the show version
command. To verify that the ARC is connecting to the network devices, use the show statistics
network-access command.
Note The ARC was formerly known as Network Access Controller. Although the name has been changed
since IPS 5.1, it still appears in IDM, IME, and the CLI as Network Access Controller, nac, and
network-access.
To troubleshoot the ARC, follow these steps:
1. Verify that the ARC is running.
2. Verify that the ARC is connecting to the network devices.
3. Verify that the Event Action is set to Block Host for specific signatures.
4. Verify that the master blocking sensor is properly configured.
For More Information
• For the procedure to verify that the ARC is running, see Verifying the ARC is Running, page C-39.
• For the procedure to verify that the ARC is connecting, see Verifying ARC Connections are Active,
page C-40.
• For the procedure to verify that the Event Action is set to Block Host, see Blocking Not Occurring
for a Signature, page C-44.
• For the procedure to verify that the master blocking sensor is properly configured, see Verifying the
Master Blocking Sensor Configuration, page C-45.
• For a discussion of ARC architecture, see Attack Response Controller, page A-12.