© 2003, cisco systems, inc. all rights reserved. csids 4.0—11-1 chapter 11 enterprise ids...
TRANSCRIPT
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-1
Chapter 11
Enterprise IDS Management
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-2
Objectives
Upon completion of this chapter, you will be able to perform the following tasks: • Define features and key concepts of the IDS MC.
• Describe the IDS MC Architecture.
• Install the IDS MC.
• Understand the IDS MC deployment.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-3
Introduction
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-4
What is the IDS MC?
The IDS MC is a web-based application that centralizes and accelerates the deployment and management of multiple IDS Sensors or IDSMs.
IDS MC
PC
Laptop
SSL
SSL
SSH
SSH
SSH
Sensor
Sensor
Sensor
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-5
IDS MC Features
Features of the IDS MC Sensor are as follows:• Web-based management platform
• Enterprise management of IDS devices
– IDS appliance running version 3.0(1) S4 or higher
– IDSM running version 3.0(5) S23 or later
– Up to 300 Sensors
• Provides the ability to create Sensor groups
• Provides a mechanism to require approval of configurations
• Provides the ability to import Sensor configurations
• Pushes signature and service pack updates to the IDS devices
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-6
Windows Installation
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-7
Server Requirements—Windows
• Hardware– IBM PC-compatible computer, 1 GHz Pentium CPU or faster– Color monitor with video card capable of viewing 16-bit of color– CD-ROM drive– 100 Mbps network connection or faster
• Memory– 1 GB of RAM minimum– 2 GB of virtual memory minimum
• Hard drive space– 12 GB of free space minimum– NTFS
• Software– Windows 2000 Server or Professional with Service Pack 3– Microsoft ODBC Driver Manager 3.510 or later
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-8
Client Access Requirements—Windows
• Hardware—IBM PC-compatible computer, 300 MHz or faster
• Memory
– 256 MB of RAM minimum
– 400 MB virtual memory
• Operating system
– Windows 98
– Windows NT 4.0
– Windows 2000 Professional with Service Pack 2 or 3
– Windows 2000 Server with Service Pack 2 or 3
– Windows 2000 Advanced Server
– Windows XP Professional
• Browser
– Internet Explorer 5.5 with Service Pack 2
– Internet Explorer 6.0
– Netscape Navigator 4.76
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-9
Installation Overview
• CiscoWorks Common Services are required for the IDS MC.
• CiscoWorks Common Services provide the CiscoWorks Server-based components software libraries, and software packages developed for the IDS MC.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-10
Installation Process
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-11
Installation Process (cont.)
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-12
Installation Process (cont.)
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-13
Upgrade Process
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-14
Solaris Installation
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-15
Server Requirements—Solaris
• Hardware
–UltraSPARC II, IIi, or IIe chipsets
–UltraSPARC III or IIIc chipsets
• Memory—1 GB of RAM minimum
• System Software—Solaris 2.7 or Solaris 2.8
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-16
Client Access Requirements—Solaris
• Hardware—Solaris SPARCstation or Sun Ultra 10 with a 333 MHz processor with one of the following operating systems:
–Solaris 2.7
–Solaris 2.8
• Memory—1 GB of RAM minimum
• Browser—Netscape Navigator 4.79
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-17
Installation Overview
• CiscoWorks Common Services are required for the IDS MC.
• CiscoWorks Common Services provide the CiscoWorks Server-based components software libraries, and software packages developed for the IDS MC.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-18
Installation Process
SETUPDIR=/cdrom/idsmc1.02002-11-14======================================================================Started : Wed Dec 11 17:01:19 CST 2002=====================================================================================- Software Install Tool Started. -========================- Welcome to the IDS Management Center and Security Monitor 1.0 Setup program.======================================================================INFO: This server architecture is 32-bit compatible.INFO: /tmp directory has 777 permissions.INFO: /etc/hosts is readable by all.INFO: OS major is 5 and OS minor is 8INFO: OS major or minor patch version not set.INFO: Checking group entry casusers.....INFO: Group created for installable packages is casusers.INFO: Checking user entry casuser.....INFO: casuser for installable packages exists.INFO: No user added to the system.INFO: Warning - No PRMOPT_INSTALL_TYPE section in TOC-file.INFO: Warning - No installation default mode set.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-19
Installation Process (cont.)
1) IDS Management Center2) Security Monitor3) All of the Above (IDS Management Center + Security Monitor)Select one of the items using its number or enter q to quit [q] 1INFO: You entered 1 as the optionLoading properties from info files, working...Making a list of dependencies, working...Making a list of dependencies for CSCOids, working...Making a list of dependencies for CSCOnsdb, working...Making a list of dependencies for CSCOossh, working...Making a list of dependencies, working...INFO: performing prerequisite: /cdrom/idsmc1.02002-11-14/info/idscom/prerequisiteINFO: performing prerequisite: CSCOids: /cdrom/idsmc1.02002-11-14/packages/CSCOids/Enter IDS MC/Security Monitor Database Password: Confirm Password : INFO: Password Encryption is Successful.Enter IDS MC/Security Monitor Database Location : [/opt/CSCOpx/MDC/Sybase/Db/IDS] Entered value is /opt/CSCOpx/MDC/Sybase/Db/IDSCreating file /tmp/cscotmp/idsinstall.properties.......
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-20
Installation Process (cont.)
======================================================================
Finished: Wed Dec 11 17:13:19 CST 2002
======================================================================
===============- Software Install Tool Completed. -=====================
======================================================================
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-21
Architecture
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-22
IDS MC Architecture Overview
User
IDS MC
CiscoWorks Common Services
Data Store
SSHIDS device
HTTP/HTTPS
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-23
IDS MC Directories
IDS MC homedirectory
\Apache \Sybase \Tomcat \Etc\ids
\updates
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-24
IDS MC Processes
The IDS MC is composed of the following processes:• IDS_Analyzer
• IDS_Backup
• IDS_DbAdminAnalyzer
• IDS_DeployDaemon
• IDS_Notifier
• IDS_Receiver
• IDS_ReportScheduler
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-25
Getting Started
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-26
CiscoWorks Login
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-27
CiscoWorks User Authorization Roles
CiscoWorks user authorization roles allow for different privileges within IDS MC:• Help Desk—Read-only for the entire system.
• Approver—Read-only for the rest of the system, and Approve configurations.
• Network Operator—Read-only for the rest of the system, and deploy configurations.
• Network Administrator—Read-only for the rest of the system, edit devices and device groups.
• System Administrator—All operations may be performed by the system administrator.
• Users can be assigned multiple authorization roles.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-28
CiscoWorks Add User
Choose Server Configuration>Setup>Security>Add Users.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-29
IDS MC Launch
Choose VPN/Security Management>Management Center>IDS Sensors.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-30
Understanding the IDS MC Interface
InstructionsPage
Path bar
Object barObject Selector handle
TOC Option bar Tabs
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-31
IDS Workflow
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-32
Workflow
The workflow consists of the following three-step process:Step 1 Generate—Allows you to generate configuration
files for Sensors.
Step 2 Approve—(Optional.) Allows you to manage configuration files proposed for deployment.
Step 3 Deploy—Allows you to submit new deployment jobs and manage deployment jobs.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-33
Workflow—Generate
Choose Deployment>Generate.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-34
Workflow—Deploy
Choose Deployment>Deploy>Submit.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-35
Workflow—Deploy (Schedule)
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-36
Workflow—Deploy (Pending)
Choose Deployment>Deploy>Pending.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-37
Workflow—Deploy (Pending) (cont.)
Choose Deployment>Deploy>Pending.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-38
Summary
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-39
Summary
• The IDS MC provides a web-based interface for configuring and managing multiple IDS Sensors.
• The IDS MC allows for a three-step process of deploying new configurations to Sensors.
– Generate the configuration.
– Approve the configuration. (Optional.)
– Deploy the configuration.
• The IDS MC can be installed on Windows-based and Solaris-based servers.
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-40
Lab Exercise
© 2003, Cisco Systems, Inc. All rights reserved. CSIDS 4.0—11-41
.4
sensorP
.4
sensorQ
.100
172.30.Q.0172.30.P.0
Lab Visual Objective
STUDENT PC
.2
.2
STUDENT PC
ROUTER
.1
.2
.2
ROUTER
.1
10.0.P.12 10.0.Q.12
10.0.P.0 10.0.Q.0
RTS RTS
.100
Pods 1–5 Pods 6–10172.26.26.0
.150
.50
WEBFTP
RBB