We have a clustered SQL environment (W2K3, SP2, SQL Server Enterprise 2005) that we just enabled IPS and Application Monitoring on both in adaptive mode. After enabling, I am monitoring the IPS, AB, and Application Log tabs in the HIPS interface to ensure nothing is being blocked. Everything that has appeared, I have created exceptions for and refreshed the policy on the nodes.
My issue is that we are unable to do a failover. Upon failover, a port gets blocked and and mirroring is disabled. Does the IPS view this as a threat and close ports? Not sure where to go from here.