Local Controller - Cisco MARS Install And Setup Manual

System Description
Figure 1-1
Global Controller span of control
The Cisco Security MARS system comprises the following components:
•
•
•
•

Local Controller

The Local Controller models are as follows—MARS 25R, 25, 55, 110R, 110, and 210. Each model
differs in its ability to process and store events from reporting devices, enabling you to accurately
address your needs based on the size of your network and the traffic volume.
Local Controllers receive and pull data from reporting devices, such as firewalls, routers, intrusion
detection/prevention systems, and vulnerability assessment systems. Based on the data obtained from
those devices, and the level of integration with them, MARS can present you with suggested mitigation
rules for detected attacks and, in some cases, push those rules to the mitigation device, which is a
network device that contains the attack by restricting network access to the infected hosts.
A Local Controller summarizes information about the health of your network based on data it receives
from the reporting devices that it monitors.
The Local Controller performs the following functions:
•
•
Install and Setup Guide for Cisco Security MARS
1-2
Relationship of Global Controller to Local Controller to Reporting/Mitigation Device
Zone A
Zone B
P2 interface 0
Global Controller
Local Controller, page 1-2
Global Controller, page 1-3
MARS Web Interface, page 1-3
Reporting and Mitigation Devices, page 1-3
Collects all raw events
Sessionizes events across different devices
Chapter 1
P1 interface 1
P1 interface 0
P1 interface 2
P2 interface 1
Zone C
Local Controller
Appliance Overview and Specifications
Internet
Zone D
OL-14672-01