Chapter 10. Deploying Cisco Network IPS

Network Intrusion Prevention System (NIPSs) can be an invaluable tool that has the capability to address many computer security challenges that you might face today. Before you research, evaluate, and purchase NIPS product, you should have some idea of what's involved in a NIPS deployment to be sure your expectations related to the deployment are correct.

This chapter helps you know what to expect during a NIPS deployment. It describes the tasks and decisions you need to make during the deployment of real-world NIPS devices, the Cisco IPS Sensor Software. A fictional company, the ACME Corporation, is used as an example to show how decisions are made at each stage in the deployment project.

ACME is headquartered in Austin, Texas. Figure 10-1 shows the network configuration for the ACME network. The entire network is not shown, only samples of the various remotes sites.

Figure 10-1. ACME Network Configuration

ACME employs approximately 9500 persons. It uses nearly 10,000 desktops and 300 servers. The company has large sales offices in New York, New York; Atlanta, Georgia; Chicago, Illinois. Portland, Oregon; and San Diego, California. There are also manufacturing plants in DeKalb, Illinois; Midland, Texas; Gary, Indiana; and Huntsville, Alabama. ACME has around 20 small sales offices scattered around the U.S. It makes a wide variety of small home appliances such as blenders, toaster ovens, irons, electronic clocks, and so on. They sell these items to retail establishments.

You NIPS deployment involves the following five major phases:

Step 1.	Understand the product
Step 2.	Predeployment planning
Step 3.	Sensor deployment
Step 4.	Tuning
Step 5.	Finalize the project

Note

This chapter is not a deployment guide and should not be used as a best practices reference. It accurately describes many of the decisions you would have to make during a Cisco NIPS deployment, but it is not a full-blown deployment guide.