37-2
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 37 Configuring Virtual Sensors
Understanding the Virtual Sensor
Note No packet is processed by more than one virtual sensor; you cannot assign the same physical
or logical interface to more than one sensor. Packets from interfaces, inline interface pairs,
inline VLAN pairs, and VLAN groups that are not assigned to any virtual sensor are
disposed of according to the inline bypass configuration that you define in the Interfaces
policy.
•The inline TCP session tracking and Normalizer modes (in the Virtual Sensors policy).
Note If you create a policy instance on an IPS device for signatures, event actions, or anomaly detection but
do not assign it to any of the virtual sensors on that device (that is, you do not use that policy instance),
then that policy instance is deleted by Security Manager during deployment.
All other policies and settings are configured on the parent device that hosts the virtual sensor. For
example, if you want to use global correlation, you configure it on the parent device and the virtual
sensors share that configuration.
You can configure up to four virtual sensors on one appliance, but you can add only three user-defined
virtual sensors. The first virtual sensor, vs0, is the base sensor and you cannot delete it. In Security
Manager, virtual sensors are presented as follows:
•The device selector in Device view contains the parent device, which doubles as the base virtual
sensor, vs0. Select this device to configure all device-level policies and to create virtual sensors in
the Virtual Sensors policy.
•Any user-defined virtual sensors are also shown in the device selector in Device view. The display
name of the real device is prepended to the beginning of the name of the virtual sensor. In most
cases, the result is that the virtual sensors appear next to the parent (real) device that the virtual
sensor is on. For example, on the host (real device) named “bob,” the virtual sensor with the name
“vs1” will appear in the device list as “bob_vs1.”
To configure the signature, anomaly detection, and event action policies for a virtual sensor, you
must select it in the device selector. You cannot configure these policies by selecting the parent
device; those policies on the parent device are for the vs0 base sensor.
The following topics explain more about virtual sensors:
•Advantages and Restrictions of Virtualization, page37-3
•Inline TCP Session Tracking Mode, page 37-3
•Understanding Normalizer Mode, page 37-4
•Assigning Interfaces to Virtual Sensors, page37-4
•Identifying the Virtual Sensors for a Device, page37-5
•Defining A Virtual Sensor, page 37-5
•Editing Policies for a Virtual Sensor, page37-9
•Deleting A Virtual Sensor, page37-10