CISCO IDS ARCHITECTURE AND COMMUNICATIONS PROTOCOLS

[ LiB ]

23. mainApp Configures the sensor's OS and IP address; responsible for starting and stopping all other IDS applications.

24. logApp Handles writing all application log messages to the log file and writes application error messages to the EventStore.

25. NAC Network Access Control is used to control managed devices.

26. ctlTransSource Controls transactions between sensors; enables NAC's master blocking capability.

27. sensorApp Sensing engine; processes signature and alarm channel configurations and generates alert events in the EventStore.

28. EventStore A 4GB, shared, memory-mapped file where all events are stored. Only sensorApp can store alert events in the EventStore.

29. cidWebServer Consists of the following servlets:

    • IDM IDS Device Manager; a Web-based device management interface.

    • Event Server Serves events to external systems such as IDS Event Viewer (IEV).

    • Transaction Server Allows external management applications to initiate control transactions with the sensor.

    • IP log server Used to serve IP logs to external systems.

    • The Event Server, Transaction Server, and IP log server all use Remote Data Exchange Protocol (RDEP).

30. Account privileges:

    • Administrator Account used to perform all operations on the sensor.

    • Operator A user who can perform all viewing and some administrative operations on the sensor.

    • Viewer A user who can perform all viewing operations.

    • Service A special role that allows the user to log in to a native OS shell; there can only be one service account at a time.

31. The default sensor administrator username and password is cisco , cisco .

32. Event Messages Contain IDS status, alarms, and error messages stored on sensors. Client applications such as IEV and Security Monitor use PostOffice Protocol or RDEP to collect these messages from sensors.

33. IP logs Messages used by the management stations to collect actual packet data detected off the sensing ports.

34. PostOffice A pushing protocol used in version 3.x and below to allow Event Messages collection. PostOffice requires a HostID, HostName, OrganizationID, and OrganizationName.

35. RDEP A pull-based application-level communication protocol that formats the event messages and IP log messages into Extensible Markup Language (XML) documents.

36. RDEP uses HTTPS (TLS/SSL) or HTTP communication between RDEP clients such as IEV and Security Monitor and the sensor.

37. Communication protocols:

    Device	IDS 4.0+ Communication Protocol
    IDS 4.0 (Master Blocker)	RDEP (HTTP/HTTPS)
    IDS Event Viewer (IEV)	RDEP (HTTP/HTTPS)
    Security Monitor	RDEP (HTTP/HTTPS)
    IDS MC	Telnet/Secure Shell (SSH)
    PIX Firewalls	Telnet/SSH
    IOS Routers	Telnet/SSH
    IDS 3.x	PostOffice

    
    

[ LiB ]