5-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter5 Configuring Virtual Sensors
Understanding the Analysis Engine
Understanding the Analysis Engine
The Analysis Engine performs packet analysis and alert detection. It monitors traffic that flows through
specified interfaces.
You create virtual sensors in the Analysis Engine. Each virtual sensor has a unique name with a list of
interfaces, inline interface pairs, inline VLAN pairs, and VLAN groups associated with it. To avoid
definition ordering issues, no conflicts or overlaps are allowed in assignments. You assign interfaces,
inline interface pairs, inline VLAN pairs, and VLAN groups to a specific virtual sensor so that no packet
is processed by more than one virtual sensor. Each virtual sensor is also associated with a specifically
named signature definition, event action rules, and anomaly detection configuration. Packets from
interfaces, inline interface pairs, inline VLAN pairs, and VLAN groups that are not assigned to any
virtual sensor are disposed of according to the inline bypass configuration.
Note
The Cisco IPS does not support more than four virtual sensors. You cannot delete the default virtual
sensor vs0.
Understanding Virtual Sensors
The sensor can receive data inputs from one or many monitored data streams. These monitored data
streams can either be physical interface ports or virtual interface ports. For example, a single sensor can
monitor traffic from in front of the firewall, from behind the firewall, or from in front of and behind the
firewall concurrently. And a single sensor can monitor one or more data streams. In this situation a single
sensor policy or configuration is applied to all monitored data streams.
A virtual sensor is a collection of data that is defined by a set of configuration policies. The virtual sensor
is applied to a set of packets as defined by interface component.
A virtual sensor can monitor multiple segments, and you can apply a different policy or configuration
for each virtual sensor within a single physical sensor. You can set up a different policy per monitored
segment under analysis. You can also apply the same policy instance, for example, sig0, rules0, or ad0,
to different virtual sensors. You can assign interfaces, inline interface pairs, inline VLAN pairs, and
VLAN groups to a virtual sensor.
Note
The default virtual sensor is vs0. You cannot delete the default virtual sensor. The interface list, the
anomaly detection operational mode, the inline TCP session tracking mode, and the virtual sensor
description are the only configuration features you can change for the default virtual sensor. You cannot
change the signature definition, event action rules, or anomaly detection policies.
Advantages and Restrictions of Virtualization
Virtualization has the following advantages:
•
You can apply different configurations to different sets of traffic.
•
You can monitor two networks with overlapping IP spaces with one sensor.
•
You can monitor both inside and outside of a firewall or NAT device.