Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Manuals

Manuals and User Guides for Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor. We have 1 Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor manual available for free PDF download: Installation And Configuration Manual

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor Installation And Configuration Manual (450 pages)

Intrusion Detection System Appliance and Module

Brand: Cisco | Category: Network Hardware | Size: 4.69 MB

Table of Contents

Table of Contents
6
Modules
36
- Introducing the Cisco Intrusion Detection System Network Module
  36
- Introducing the Cisco Catalyst 6500 Series Intrusion Detection System Services Module
  38
Supported Sensors
40
Setting the Time on Sensors
42
Installation Preparation
44
Working in an ESD Environment
45
Chapter 2 Installing the IDS-4210

47
Installing the IDS-4215

62
- Front and Back Panel Features
  62
- Specifications
  64
- Accessories
  65
- Surface Mounting
  66
- Rack Mounting
  67
- Installing the IDS-4215
  69
- Removing and Replacing the Chassis Cover
  72
  - Removing the Chassis Cover
    73
  - Replacing the Chassis Cover
    75
- Removing and Replacing the IDE Hard-Disk Drive
  77
  - Removing the Hard-Disk Drive
    78
  - Replacing the Hard-Disk Drive
    80
- Removing and Replacing the Compact Flash Device
  81
  - Removing the Compact Flash Device
    81
  - Replacing the Compact Flash Device
    83
- Removing and Installing the 4FE Card
  85
  - Removing the 4FE Card
    85
  - Installing the 4FE Card
    87
Chapter 4 Installing the IDS-4220 and IDS-4230

91
Chapter 5 Installing the IDS-4235 and IDS-4250

99
- Front-Panel Features and Indicators
  100
- Back-Panel Features and Indicators
  102
- Specifications
  103
- Installing Spare Hard-Disk Drives
  104
- Upgrading the BIOS
  105
- Using the TCP Reset Interface
  106
- Installing the IDS-4235 and IDS-4250
  107
- Installing the Accessories
  109
  - Accessories Package Contents
    110
  - Installing and Removing the Bezel
    110
  - Installing the Power Supply
    111
  - Installing Optional PCI Cards
    114
  - Disconnecting the XL Card Fiber Ports
    117
  - Removing and Replacing the SCSI Hard-Disk Drive
    118
    
    Removing the SCSI Hard-Disk Drive
    119
    
    Replacing the SCSI Hard-Disk Drive
    119
  - Four-Post Rack Installation
    121
    
    Recommended Tools and Supplies
    121
    
    Rack Kit Contents
    121
    
    Installing the Slide Assemblies
    121
    
    Installing the Appliance in the Rack
    121
    
    Installing the Cable-Management Arm
    126
    
    Routing the Cables
    130
  - Two-Post Rack Installation
    132
    
    Recommended Tools and Supplies
    133
    
    Rack Kit Contents
    133
    
    Marking the Rack
    133
    
    Installing the Slide Assemblies in the Rack
    133
Chapter 6 Installing the IPS-4240 and IPS-4255

141
- Front and Back Panel Features
  142
- Specifications
  145
- Accessories
  146
- Rack Mounting
  147
- Installing the IPS-4240 and IPS-4255
  149
Installing the NM-CIDS

154
- Specifications
  154
- Software and Hardware Requirements
  154
- Hardware Architecture
  156
- Front Panel Features
  157
- Interfaces
  157
- Installation and Removal Instructions
  158
  - Required Tools
    159
  - Installing the NM-CIDS
    159
    
    Installing the NM-CIDS Offline
    159
    
    Installing an NM-CIDS Using OIR Support
    159
  - Removing the NM-CIDS
    163
    
    Removing the NM-CIDS Offline
    163
    
    Removing the NM-CIDS Using OIR Support
    163
  - Blank Network Module Panels
    166
Installing the IDSM-2

167
- Specifications
  167
- Software and Hardware Requirements
  168
- Supported IDSM-2 Configurations
  169
- Using the TCP Reset Interface
  170
- Front Panel Description
  170
- Installation and Removal Instructions
  171
  - Required Tools
    172
  - Slot Assignments
    172
  - Installing the IDSM-2
    173
  - Verifying the IDSM-2 Installation
    177
  - Removing the IDSM-2
    179
Obtaining Software

183
CHAPTER 10 Configuring the Sensor Using the CLI

198
- Sensor Initial Configuration Tasks
  198
  - Initializing the Sensor
    198
  - Assigning and Enabling the Sensing Interface
    205
  - Sensing Interfaces
    207
  - Creating the Service Account
    208
  - Logging in to the Sensor
    210
  - Changing a Password
    211
  - Adding a User
    212
  - Removing a User
    213
  - Adding Trusted Hosts
    214
  - Adding Known Hosts to the SSH Known Hosts List
    215
  - Configuring the Sensor to Use an NTP Server as Its Time Source
    217
  - Configuring a Cisco Router to be an NTP Server
    218
- Sensor Administrative Tasks
  220
- Displaying Tech Support Information
  227
- Displaying and Clearing Statistics
  229
- Sensor Configuration Tasks
  231
  - Configuring Signatures
    231
    
    Configuring Alarm Channel System Variables
    231
    
    Configuring Alarm Channel Event Filters
    233
    
    Viewing Signature Engine Parameters
    235
    
    Configuring Virtual Sensor System Variables
    238
    
    Tuning Signature Engines
    241
  - IP Logging
    246
    
    Manual IP Logging for a Specific IP Address
    247
    
    Automatic IP Logging for a Specific Signature
    249
    
    Disabling IP Logging
    251
    
    Copying IP Log Files to be Viewed
    252
  - Configuring Blocking
    253
    
    Understanding Blocking
    253
    
    Before Configuring Blocking
    255
    
    Supported Blocking Devices
    255
    
    Configuring Blocking Properties
    256
    
    Configuring Addresses Never to Block
    261
    
    Configuring Logical Devices
    262
    
    Configuring Blocking Devices
    263
    
    Configuring the Sensor to be a Master Blocking Sensor
    269
    
    Obtaining a List of Blocked Hosts and Connections
    271
    
    How to Set up Manual Blocking and How to Unblock
    272
- NM-CIDS Configuration Tasks
  273
  - Configuring Cisco IDS Interfaces on the Router
    274
  - Establishing Cisco IDS Console Sessions
    276
    
    Using the Session Command
    276
    
    Suspending a Session and Returning to the Router
    277
    
    Closing an Open Session
    277
    
    Using Telnet
    278
  - Rebooting the NM-CIDS
    279
  - Setting up Packet Capture
    280
  - Checking the Status of the Cisco IDS Software
    281
  - Supported Cisco IOS Commands
    282
- IDSM-2 Configuration Tasks
  283
  - Configuring the Catalyst 6500 Series Switch for Command and Control Access to the IDSM-2
    283
    
    Catalyst Software
    285
    
    Cisco IOS Software
    285
    
    Using SPAN for Capturing IDS Traffic
    286
    
    Configuring VACLS to Capture IDS Traffic
    288
    
    Using the Mls Ip Ids Command for Capturing IDS Traffic
    292
  - Miscellaneous Tasks
    294
    
    Enabling a Full Memory Test
    294
    
    Resetting the IDSM-2
    294
    
    Catalyst Software Commands
    299
    
    Cisco IOS Software Commands
    302
- Reimaging Appliances and Modules
  306
  - Reimaging the Appliance
    306
    
    Recovering the Application Partition Image
    307
    
    Upgrading the Recovery Partition Image
    308
    
    Installing the IDS-4215 System Image
    309
  - Reimaging the NM-CIDS Application Partition
    315
  - Reimaging the IDSM-2
    320
    
    Reimaging the IDSM-2
    321
    
    Reimaging the Maintenance Partition
    323
Appendix

327
Intrusion Detection System Architecture

327
- System Overview
  328
  - Software Architecture Overview
    328
  - Show Version Command Output
    330
  - User Interaction
    331
  - New Features in Version 4.X
    332
- System Components
  333
  - Mainapp
    334
    
    Authenticating Users
    334
    
    Configuring Authentication on the Sensor
    338
    
    Managing TLS and SSH Trust Relationships
    338
  - Logapp
    341
  - Nac
    342
    
    About NAC
    343
    
    NAC-Controlled Devices
    345
    
    NAC Features
    345
    
    Acls and Vacls
    348
    
    Maintaining State Across Restarts
    349
    
    Connection-Based and Unconditional Blocking
    350
    
    Blocking with the PIX Firewall
    351
    
    Blocking with the Catalyst 6000
    353
  - Transactionsource
    354
  - Webserver
    355
  - Cli
    355
    
    User Account Roles
    355
    
    Service Account
    355
    
    CLI Behavior
    355
    
    Regular Expression Syntax
    355
- Eventstore
  362
  - About the Eventstore
    362
  - Major Data Structures
    362
  - IDS Events
    362
- System Architectural Details
  370
  - Communications
    370
- Idapi
  
  372
- Rdep
  
  373
  - Sensor Directory Structure
    374
  - Summary of Applications
    375
Appendix

379
Troubleshooting

379
- Preventive Maintenance
  379
- Disaster Recovery
  380
- Troubleshooting the 4200 Series Appliance
  382
  - Communication
    382
    
    Cannot Access the Sensor through the IDM or Telnet And/Or SSH
    383
    
    IDM Cannot Access the Sensor
    385
    
    Access List Misconfiguration
    388
    
    Duplicate IP Address Shuts Interface down
    388
  - Sensorapp and Alerting
    389
    
    Sensing Process Not Running
    389
    
    Physical Connectivity, SPAN, or VACL Port Issue
    390
    
    Unable to See Alerts
    392
    
    Cleaning up a Corrupted Sensorapp Configuration
    394
    
    Running Sensorapp in Single CPU Mode
    395
    
    Bad Memory on the IDS-4250-XL
    396
  - Blocking
    396
    
    Verifying NAC Is Running
    397
    
    Verifying NAC Is Connecting
    398
    
    Device Access Issues
    400
    
    Verifying the Interfaces/Directions on the Network Device
    401
    
    Enabling SSH Connections to the Network Device
    402
    
    Blocking Not Occurring for a Signature
    403
    
    Verifying the Master Blocking Sensor Configuration
    404
  - Logging
    406
    
    Enabling Debug Logging
    406
    
    Zone Names
    409
    
    Directing Cidlog Messages to Syslog
    409
Ntp

411
- Verifying that the Sensor Is Synchronized with the NTP Server
  411
- NTP Reconfiguration Defect
  413
- NTP Server Connectivity Problem
  413
- TCP Reset
  415
  - Reset Not Occurring for a Signature
    415
  - Using the TCP Reset Interface
    415
- Software Upgrade
  417
- Troubleshooting the IDSM-2
  422
- Gathering Information
  430
  - Show Tech-Support Command
    430
    
    Displaying Tech Support Information
    431
    
    Show Tech-Support Command Output
    433
  - Show Version Command
    434
    
    Displaying the Current Version
    435
  - Show Configuration/More Current-Config Command
    438
  - Show Statistics Command
    439
    
    Displaying Statistics
    440
    
    Show Statistics Command Output
    441
  - Show Interfaces Command
    442
    
    Show Interfaces Command Output
    443
  - Show Events Command
    444
    
    Sensor Events
    445
    
    Show Events Command
    445
    
    Displaying and Clearing Events
    446
    
    Show Events Command Output
    447
  - Ciddump Script
    448
  - Uploading and Accessing Files on the Cisco FTP Site
    449

Advertisement

Advertisement

Related Products

Cisco Categories

Switch

Switch IP Phone

Network Router

Network Router Wireless Access Point Conference System

More Cisco Manuals