PostOffice protocol in v4.0 sensors

[serguei.bezverkhi]

Hi,

It looks like in v4.0 of the sensor there is no any settings for PostOffice as it was with v3.0. Does it mean that Cisco is moving from old NetRanger concept, or PostOffice protocol will be added later in v4.0?

Thank you

[kleem]

Support for the PostOffice protocol was removed from the Sensors beginning with v4.0. It will not be added to future releases.

The current release of the IDS MC and SM (part of the VMS bundle) support both older Sensors with the PostOffice protocol as well as the v4.0 Sensors which use the Remote Data Exchange Protocol (RDEP). This allows customers to have older and newer Sensors reporting to a single management application.

[ovanjara]

Yes, you are correct. The 4.0 architecture revolves around something called RDEP, which would you say is a sort of replacement for the post office protocol. It uses SSH as opposed to UDP 45000.

[jeff.k]

Ssh can be used for CLI access to the sensor, and can also be used for communication between the sensor and a blocking device.

RDEP is actually a subset of http, and I believe it uses XML over http or TLS/SSL for secure communication of events, configuration information and as well as http/https protocol for iplogs.

The link that Klee gave earlier provides further clarification.

Jeff