Legal Disclaimer: The resource assets in this website may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names.
Troubleshooting
How do I capture packet information for troubleshooting?
To capture packet information for troubleshooting, select the check box in the tab. For more information, see Troubleshooting.
How do I troubleshoot when Gateway IDS/IPS engine drops data packets without generating alerts?
To troubleshoot when data packets are dropped without generating alerts, you need to connect to IDPS Intrusion Detection and Prevention System (IDPS) monitors, detects, and prevents threats in the inbound and outbound traffic. Aruba IDPS provides an extra layer of protection that actively analyzes the network and takes actions on the traffic flows based on the defined rules. It inspects data packets, and if any threat is identified, acts real-time to prevent it. supported Branch Gateway through SSH Secure Shell. SSH is a network protocol that provides secure access to a remote device. and execute the debugging CLI commands. For more information, see Troubleshoot Packet Drops.
How do I troubleshoot when Gateway IDS/IPS engine generates threat alerts and drops data packets for normal traffic?
To troubleshoot when Gateway IDS/IPS generates threat alerts and drops data packets for normal traffic, you must allow the threat signature for the traffic to flow. After allowing the threat signatures, contact HPE Aruba NetworkingTechnical Support for further assistance. For more information, see Troubleshoot Packet Drops.
When doing a file sharing (SMB), the traffic is slow?
SMB Server Message Block or Small and Medium Business. Server Message Block operates as an application-layer network protocol mainly used for providing shared access to files, printers, serial ports, and for miscellaneous communications between the nodes on a network. transfers consume more CPU Central Processing Unit. A CPU is an electronic circuitry in a computer for processing instructions. memory and resources resulting in increased latency. Perform the following steps as a workaround and check the speed. After trying the workaround if file sharing is slow, raise a support ticket.
To share SMB with optimum speed, complete the following steps:
-
Verify the server details on Add SIEM Security Incident and Event Management (SIEM) is a server where Aruba IDPS sends the threat data to perform advanced analysis and generate reports. SIEM provides a holistic picture of the security posture by aggregating and correlating data from disparate sources in the network. Server window.
-
Ensure Enable reporting of threats to SIEM systems is selected.
-
Use Test Connection on the SIEM tab to ensure that server configuration is reachable.
-
If speed is slow, re-do the server configuration.
For more information, see Configure SIEM.
Alternatively, if you want to skip inspection for SMB file transfers on 9xxx platforms that are IDPS enabled, use the Bypass Inspection for Large Dataflows option under the Gateways IDS Intrusion Detection System. IDS monitors a network or systems for malicious activity or policy violations and reports its findings to the management system deployed in the network./IPS Intrusion Prevention System. The IPS monitors a network for malicious activities such as security threats or policy violations. The main function of an IPS is to identify suspicious activity, log the information, attempt to block the activity, and report it. > Policies tab. For more information, see Manage Rules in IDPS Policies.
How do I capture the packets on the IDPS engine ports?
You can use the idps extended packet capture CLI.
How to identify if the session is redirected to the IDPS engine?
Use show datapath session CLI in the device to see if it has the Z flag for sessions redirected to the engine.
Can I extend the traffic inspection time?
Yes, you can extend inspection time by another 10 minutes by clicking the Refresh Extended Packet Capture button. For more information, see Troubleshooting.
Threat events do not reach the Splunk server. What could be wrong?
Check the configured SIEM URL Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. format. For more information, see Configure SIEM.
If the Foudantion or Advanced with Security license did not enable IDPS on the gateway, what is the solution?
Workaround is to unassign the gateway subscription, reboot the device, and re-assign the license. After that an automatic reboot is processed, and it will resolve the issue.
