TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Hi Guys! I had the same problem. I had to edit one of the .policy files on
the detector being re-assigned. Unfortunately, I'm at home a do not have
access to my IDS deployment to let you know what file it is exactly. I
suggest searching for any references (by IP) of the old master console in
the *.policy files and replacing it with the new master console. Stop/Start
the agent - this did it for me!
Again, my apologies for not providing specifics. Start with custom.policy.
Cheers!
Simon J. Herring
FrontWay, Columbus, OH
-----Original Message-----
From: Michael Wilson
To: Norton.Stephen
Cc: [EMAIL PROTECTED]
Sent: 8/24/00 4:24 PM
Subject: RE: Changing Master Console Monitor
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message
to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
problems!
------------------------------------------------------------------------
----
Stephen,
That's what I thought, and what the documentation says.
However,
when we tried this, it didn't work. Very confusing; the network sensor
insisted that it was still under the control of a non-existent machine.
-Mike Wilson
-Sr. Security Specialist
-UNIFIED Technologies
-Troy, NY
On Thu, 24 Aug 2000, Norton.Stephen wrote:
> Stopping and restarting the network engines will also relinquish
Master
> Console status. The console is authenticated to the sensor through a
secure
> channel. Anything that breaks that authenticated connection will
relinquish
> the MC status.
>
>
> Stephen P. Norton
> Franchise Tax Board
> [EMAIL PROTECTED]
>
>
> -----Original Message-----
> From: Michael Wilson [mailto:[EMAIL PROTECTED]]
> Sent: Thursday, August 24, 2000 12:26 PM
> To: [EMAIL PROTECTED]
> Subject: RE: Changing Master Console Monitor
>
>
>
> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your
message to
> [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
>
------------------------------------------------------------------------
----
>
>
> More interesting to me is the question of how you fix things if,
> for example, you have a master console assigned, but then that machine
> goes away for whatever reason, without backups. If you can't go and
> relinquish properly, then what? I imagine that this is the situation
> under discussion - otherwise he probably would have already tried to
> release it.
> I've got a situation like this at a customer site. In this
case,
> it's immaterial, since we're doing a complete reinstall of the probes
> for other reasons anyway, but I'm curious to know how to make a probe
> release it's master without having the master available to make the
> request.
>
> -Mike Wilson
> -Sr. Security Specialist
> -UNIFIED Technologies
> -Troy, NY
>
> On Thu, 24 Aug 2000, Norton.Stephen wrote:
>
> >
> > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your
message
> to
> > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any
> problems!
> >
>
------------------------------------------------------------------------
----
> >
> > The message indicates another console ('hostname') has obtained
Master
> > Controller status. This is granted by the sensors on a first-come,
> > first-served basis. If you want your console to be the designated
Master
> > Controller, you will need to go to the 'hostname' console and
relinquish
> the
> > Master Controller status, then go back to your console and re-add
the
> > network engine. If you are only monitoring the engine, and not
making any
> > configuration changes, you shouldn't need Master Controller status.
> >
> >
> > Stephen P. Norton
> > Franchise Tax Board
> > [EMAIL PROTECTED]
>
