5 Replies Latest reply on Aug 16, 2011 9:52 AM by netsec

    RSD Sensors Staying Active

      Hi all.  I am having an interesting issue.  I am updating my sensors on the subents that we monitor.  Generally my company likes to have 1 active sensor with 2 passive sensors per subnet.  Whenever I remove the old sensors and re-install them they all stay Active.  Non of the sensors switch over to passive like before.  I am updating to version 4.5.0.1082

       

      Thanks all.

        • 1. Re: RSD Sensors Staying Active

          Please modify your RSD policy  you should be able to do that from there

           

          Message was edited by: allamiro on 8/15/11 4:21:22 PM CDT
          • 2. Re: RSD Sensors Staying Active

            Thanks Allamiro for taking time to respond.

             

            I looked at our RSD policy and it appears to be the same as before.  It doesnt appear to have changed any.  So I would suspect all the rogue sensors to use that policy like they did before the updated version. 

            • 3. Re: RSD Sensors Staying Active
              netsec

              Hey Kire98

               

              Check inside the server settings, and change the settings for rogue system, in there you can specify how many sensors should be active or passive.

              • 4. Re: RSD Sensors Staying Active

                Hey thanks netsec.  That appears to be what I need to do.  That setting is now set at 2 instead of 1 like we had previously.  Dont know why or how that changed. 

                 

                We updated EPO some time ago (2 months).  We are still 4.5 but at the current patch level.  I am assuming it could have changed then.  Does McAfee reccomend 2 active sensors?  I notice when we have rogue detections we arent notified very promptly (5 to 10 mins later).   Do you know if this will make for faster detections?

                • 5. Re: RSD Sensors Staying Active
                  netsec

                  Hey kire98

                   

                  You can go and edit the automated response task

                  In there edit the aggression limit to "