In this month's Chalk Talk, Dave Burns and Odunayo Adesina discuss deciding how and where to use the Cisco IPS, how to get it initialized/inline, and how to manage it quickly.
The task of deploying a network IPS (Intrusion Prevention System) device can be quite overwhelming for a network or security professional that hasn’t done it before. The first and most important step in deploying a network IPS device is understanding the various modes and which mode applies to the deployment at hand. The following modes are supported on the Cisco IPS sensors:
All of these modes are discussed in great detail in the online configuration guides found on Cisco.com. In this article we’ll first focus on the most commonly deployed Inline mode, which Is Inline Interface Pair Mode. Figure 1 shows an example at a high level of how an Inline VLAN Pair Mode is commonly deployed around the world today.
Figure 1: Inline VLAN Pair Mode Examples
Before administrators/engineers can put the sensor in any mode or even manage it, they first must initialize the sensor. The steps below can also be found in the Cisco IPS Configuration guide on Cisco.com. It is highly recommended that administrators pay special attention to any notes found in the configuration guides in addition to the steps below.
The sensor is now initialized and ready for further configuration.
Now that the sensor is initialized, the sensor is now ready for interface configurations. The following steps were taken from the Cisco IPS Configuration Guide, and summarized for the purposes of this article.
The Cisco IPS sensor is now configured for Inline VLAN Pair Mode as the example in Figure 1 shows.
With the initial setup of the IPS completed above, further configuration, management, and monitoring can be done using the Cisco IPS Manager Express (IME). To download IME, go to the url www.cisco.com/go/ime and follow the instructions to install.
After it is installed, complete the following steps:
Note: There are options to choose to connect using https or http. If you choose https, the sensor will present you with a certificate which, once you verify and accept, is stored locally for future use during connections to the Sensor. There are also options to pull in most recent events, specify a specific time interval, or exclude some events.
3. After all the parameters have been entered, click OK. Figure 2 below shows the Add Device window pop-up from IME..
Figure2: Adding IPS Sensors to Cisco IME
Once connected, the Sensor is displayed in the Device list with information related to the Sensor such as Time, Device Name, IP Address, Device Type, Event Status, Sensor Health, Global Correlation Status, version, License Expiration, Load, Memory, CPU and Signature Version. More details can be obtained in the Device Details pane. This altogether provides information at a glance.
To get a detailed presentation of this information, from the Home View, click on Dashboards (Home > Dashboards > Dashboard) as shown in Figure 3 below:
Figure 3: Monitoring IPS Sensors using Cisco IME
The Health Dashboard and the Events Dashboard are pre-populated with Gadgets by default. More Gadgets can be added to either of the dashboards and a customizable dashboard can be added by clicking on Add Dashboard located next to Video Help in the top right of the Dashboard pane.
In this article we briefly discussed the Cisco IPS sensor and one of the most commonly deployed modes of operation. We also discussed a method of managing the sensor once it is deployed. The Cisco IPS sensor is quite versatile and isn’t a one size fits all, so it’s important to follow the best practices around discovery, design, planning, etc. As a best practice for any product deployment, review the data sheets, design guides, and configuration guides available on Cisco.com.
By David Burns, Odunayo Adesina, Keith Barker
Published: October 25, 2011
US SRP: $55.99
Published by Cisco Press.