CIDS 4210 - Command and Control IP

[bz]

If I was to place a sensor on the DMZ, let's say the 192.168.205.0 segment, do I need to set the command and control interface's IP address to a 192.168.205.x address? What is the best practice in setting this IP address, a DMZ address or internal address? Thanks in advance!

[yusuff]

Wherever you place, as long as you have IP connectivity with the Director/CSPM, its ok.

For Best practise, refer to SAFE blueprint

http://www.cisco.com/warp/public/779/largeent/issues/security/safe.html

R/Yusuf

[danrodri]

The best practice is to put the command and control interface on a different network (more secure) than the monitoring.