Adding Modules To A Cisco Switch; Add Available Modules - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Cisco Switch Devices
(Optional) If you defined an access IP and selected and configured an access type, click Discover to
Step 9
determine the device settings
Result: If the username and password are correct and the MARS Appliance is configured as an
administrative host for the device, the "Discovery is done." dialog box appears when the discovery
operation completes. Otherwise, an error message appears. After the initial pull, the MARS Appliance
pulls based on the schedule that you define. For more information, see
page
To add this device to the MARS database, click Submit.
Step 10
Result: The submit operation records the changes in the database tables. However, it does not load the
changes into working memory of the MARS Appliance. The activate operation loads submitted changes
into working memory.
Click Activate.
Step 11
Result: MARS begins to sessionize events generated by this device and evaluate those events using the
defined inspection and drop rules. Any events published by the device to MARS before activation can
be queried using the reporting IP address of the device as a match criterion. For more information on the
activate action, see
After submitting, you can add modules. See

Adding Modules to a Cisco Switch

In MARS, you can represent, discover, and monitor modules that are installed in Cisco switches. These
modules perform special purpose security functions for the switch, such as firewall or intrusion detection
and prevention. MARS recognizes the following switch modules and versions:
•
•
•
•
To add a module, you must first add the base module, which is the Cisco switch. After the base module
is defined in the web interface, you can discover the modules that are installed in the switch (click Add
Available Module) or add them manually (click Add Module).
For instructions on adding and configuring a firewall services module (FWSM), see
Devices (PIX, ASA, and FWSM), page
For instructions on adding and configuring an intrusion detection or prevention services module (IDSM
or IPSM), see
This section contains the following topics:
•
•

Add Available Modules

When you perform a discovery operation on a base module, MARS lists the discovered modules. From
this list, you can select the modules to monitor using MARS.
User Guide for Cisco Security MARS Local Controller
3-14
2-39.
Activate the Reporting and Mitigation Devices, page
Cisco FWSM 1.1, 2.2, and 2.3
Cisco IDS 3.1 and 4.0
Cisco IPS 5.x
Cisco IOS 12.2
Cisco IPS Modules, page
Add Available Modules, page 3-14
Add Cisco IOS 12.2 Modules Manually, page 3-15
Chapter 3
Adding Modules to a Cisco Switch, page
4-1.
6-10.
Configuring Router and Switch Devices
Scheduling Topology Updates,
2-27.
3-14.
Cisco Firewall
78-17020-01