1 / 41

Chapter 11

Chapter 11. Enterprise IDS Management. Objectives. Upon completion of this chapter, you will be able to perform the following tasks: Define features and key concepts of the IDS MC. Describe the IDS MC Architecture. Install the IDS MC. Understand the IDS MC deployment. Introduction. PC.

heba
Download Presentation

Chapter 11

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 11 Enterprise IDS Management

  2. Objectives • Upon completion of this chapter, you will be able to perform the following tasks: • Define features and key concepts of the IDS MC. • Describe the IDS MC Architecture. • Install the IDS MC. • Understand the IDS MC deployment.

  3. Introduction

  4. PC What is the IDS MC? • The IDS MC is a web-based application that centralizes and accelerates the deployment and management of multiple IDS Sensors or IDSMs. SSH Sensor SSL SSH SSL Sensor SSH IDS MC Laptop Sensor

  5. IDS MC Features Features of the IDS MC Sensor are as follows: • Web-based management platform • Enterprise management of IDS devices • IDS appliance running version 3.0(1) S4 or higher • IDSM running version 3.0(5) S23 or later • Up to 300 Sensors • Provides the ability to create Sensor groups • Provides a mechanism to require approval of configurations • Provides the ability to import Sensor configurations • Pushes signature and service pack updates to the IDS devices

  6. Windows Installation

  7. Server Requirements—Windows • Hardware • IBM PC-compatible computer, 1 GHz Pentium CPU or faster • Color monitor with video card capable of viewing 16-bit of color • CD-ROM drive • 100 Mbps network connection or faster • Memory • 1 GB of RAM minimum • 2 GB of virtual memory minimum • Hard drive space • 12 GB of free space minimum • NTFS • Software • Windows 2000 Server or Professional with Service Pack 3 • Microsoft ODBC Driver Manager 3.510 or later

  8. Client Access Requirements—Windows • Hardware—IBM PC-compatible computer, 300 MHz or faster • Memory • 256 MB of RAM minimum • 400 MB virtual memory • Operating system • Windows 98 • Windows NT 4.0 • Windows 2000 Professional with Service Pack 2 or 3 • Windows 2000 Server with Service Pack 2 or 3 • Windows 2000 Advanced Server • Windows XP Professional • Browser • Internet Explorer 5.5 with Service Pack 2 • Internet Explorer 6.0 • Netscape Navigator 4.76

  9. Installation Overview • CiscoWorks Common Services are required for the IDS MC. • CiscoWorks Common Services provide the CiscoWorks Server-based components software libraries, and software packages developed for the IDS MC.

  10. Installation Process

  11. Installation Process (cont.)

  12. Installation Process (cont.)

  13. Upgrade Process

  14. Solaris Installation

  15. Server Requirements—Solaris • Hardware • UltraSPARC II, IIi, or IIe chipsets • UltraSPARC III or IIIc chipsets • Memory—1 GB of RAM minimum • System Software—Solaris 2.7 or Solaris 2.8

  16. Client Access Requirements—Solaris • Hardware—Solaris SPARCstation or Sun Ultra 10 with a 333 MHz processor with one of the following operating systems: • Solaris 2.7 • Solaris 2.8 • Memory—1 GB of RAM minimum • Browser—Netscape Navigator 4.79

  17. Installation Overview • CiscoWorks Common Services are required for the IDS MC. • CiscoWorks Common Services provide the CiscoWorks Server-based components software libraries, and software packages developed for the IDS MC.

  18. Installation Process • SETUPDIR=/cdrom/idsmc1.02002-11-14 • ====================================================================== • Started : Wed Dec 11 17:01:19 CST 2002 • ====================================================================== • ===============- Software Install Tool Started. -===================== • ===- Welcome to the IDS Management Center and Security Monitor 1.0 Setup program. • ====================================================================== • INFO: This server architecture is 32-bit compatible. • INFO: /tmp directory has 777 permissions. • INFO: /etc/hosts is readable by all. • INFO: OS major is 5 and OS minor is 8 • INFO: OS major or minor patch version not set. • INFO: Checking group entry casusers..... • INFO: Group created for installable packages is casusers. • INFO: Checking user entry casuser..... • INFO: casuser for installable packages exists. • INFO: No user added to the system. • INFO: Warning - No PRMOPT_INSTALL_TYPE section in TOC-file. • INFO: Warning - No installation default mode set.

  19. Installation Process (cont.) • 1) IDS Management Center • 2) Security Monitor • 3) All of the Above (IDS Management Center + Security Monitor) • Select one of the items using its number or enter q to quit [q] 1 • INFO: You entered 1 as the option • Loading properties from info files, working... • Making a list of dependencies, working... • Making a list of dependencies for CSCOids, working... • Making a list of dependencies for CSCOnsdb, working... • Making a list of dependencies for CSCOossh, working... • Making a list of dependencies, working... • INFO: performing prerequisite: /cdrom/idsmc1.02002-11-14/info/idscom/prerequisite • INFO: performing prerequisite: CSCOids: /cdrom/idsmc1.02002-11-14/packages/CSCOids/ • Enter IDS MC/Security Monitor Database Password: • Confirm Password : • INFO: Password Encryption is Successful. • Enter IDS MC/Security Monitor Database Location : [/opt/CSCOpx/MDC/Sybase/Db/IDS] • Entered value is /opt/CSCOpx/MDC/Sybase/Db/IDS • Creating file /tmp/cscotmp/idsinstall.properties.... • . • . • .

  20. ============================================================================================================================================ Finished: Wed Dec 11 17:13:19 CST 2002 ====================================================================== ===============- Software Install Tool Completed. -===================== ====================================================================== Installation Process (cont.)

  21. Architecture

  22. IDS MC Architecture Overview IDS device SSH IDS MC HTTP/HTTPS Data Store User CiscoWorks Common Services

  23. IDS MC Directories IDS MC home directory \Apache \Sybase \Tomcat \Etc\ids \updates

  24. IDS MC Processes • The IDS MC is composed of the following processes: • IDS_Analyzer • IDS_Backup • IDS_DbAdminAnalyzer • IDS_DeployDaemon • IDS_Notifier • IDS_Receiver • IDS_ReportScheduler

  25. Getting Started

  26. CiscoWorks Login

  27. CiscoWorks User Authorization Roles • CiscoWorks user authorization roles allow for different privileges within IDS MC: • Help Desk—Read-only for the entire system. • Approver—Read-only for the rest of the system, and Approve configurations. • Network Operator—Read-only for the rest of the system, and deploy configurations. • Network Administrator—Read-only for the rest of the system, edit devices and device groups. • System Administrator—All operations may be performed by the system administrator. • Users can be assigned multiple authorization roles.

  28. CiscoWorks Add User Choose Server Configuration>Setup>Security>Add Users.

  29. IDS MC Launch Choose VPN/Security Management>Management Center>IDS Sensors.

  30. Understanding the IDS MC Interface Path bar TOC Option bar Tabs Object Selector handle Instructions Object bar Page

  31. IDS Workflow

  32. Workflow • The workflow consists of the following three-step process: Step 1 Generate—Allows you to generate configuration files for Sensors. Step 2 Approve—(Optional.) Allows you to manage configuration files proposed for deployment. Step 3 Deploy—Allows you to submit new deployment jobs and manage deployment jobs.

  33. Workflow—Generate Choose Deployment>Generate.

  34. Workflow—Deploy Choose Deployment>Deploy>Submit.

  35. Workflow—Deploy (Schedule)

  36. Workflow—Deploy (Pending) Choose Deployment>Deploy>Pending.

  37. Workflow—Deploy (Pending) (cont.) Choose Deployment>Deploy>Pending.

  38. Summary

  39. Summary • The IDS MC provides a web-based interface for configuring and managing multiple IDS Sensors. • The IDS MC allows for a three-step process of deploying new configurations to Sensors. • Generate the configuration. • Approve the configuration. (Optional.) • Deploy the configuration. • The IDS MC can be installed on Windows-based and Solaris-based servers.

  40. Lab Exercise

  41. Lab Visual Objective WEBFTP .50 172.26.26.0 .150 Pods 1–5 Pods 6–10 .1 .1 RBB 172.30.P.0 172.30.Q.0 sensorP sensorQ .2 .2 ROUTER ROUTER .2 .4 .2 .4 10.0.Q.0 10.0.P.0 .100 .100 RTS RTS STUDENT PC STUDENT PC 10.0.P.12 10.0.Q.12

More Related