Scenario
Wrong country name appears in ACL alerts/ACL logs
Applicable to Sensor models: NS-series and Virtual IPS Sensors
Sensor software version: 10.1, 11.1
Problem type to be solved
Wrong country name is displayed in the ACL alerts/ACL logs when forwarded to third-party software either from the Sensor or from the Manager.
Data/Information Collection
Execute show acl stats in the Sensor CLI.
Troubleshooting Steps
Execute the show acl stats command in the Sensor CLI to fetch the following data from the management process:
Number of ACL alerts sent by the datapath processor to the management processor
Number of ACL alerts sent from the management processor to the Manager or third-party software tool.
If there is difference between the received and sent/sent directly count by a large value but within 10,000, it indicates that the buffer to keep the ACL alerts at management processor is full. This might potentially be the cause for the issue.
intruShell@mil-ips-01> show acl stats
[Acl Alerts]
Received : 0
Suppressed : 0
Sent : 0
Sent Direct : 0
Stateless ACL Fwd count : 0
The buffer kept for receiving the ACL alerts from datapath processor is full, and is not flushed in an event like ACL alert suppression disabled/enabled. In this type of scenario, if the ACL alert buffer is not flushed, the country name for the old ACL alert is mixed with the new ACL alert, which results in the wrong country name in the ACL logs.
Note
If the country name is displayed wrong in the ACL alert, for either source IP address or destination IP address, there is an issue with the Sensor. If you are not able to solve the problem even after repeating the steps explained in troubleshooting, or the problem is not understood, contact Trellix Support for further assistance.