A-5
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
Security Features
You interact with the CiscoIPS in the following ways:
•
Configure device parameters
You generate the initial configuration for the system and its features. This is an infrequent task,
usually done only once. The system has reasonable default values to minimize the number of
modifications you must make. You can configure CiscoIPS through th e CLI, IDM, IME, CSM,
ASDM, or through another application using SDEE.
•
Tune
You make minor modifications to the configuration, primarily to Analysis Engine, which is the
portion of the application that monitors network traffic. You can tune the system frequently after
initially installing it on the network until it is operating efficiently and only producing information
you find useful. You can create custom signatures, enable features, or apply a service pack or
signature update. You can tune Cisco IPS through the CLI, IDM, IME, CSM, ASDM, or through
another application using SDEE.
•
Update
You can schedule automatic updates or apply updates immediately to the applications and signature
data files. You can update Cisco IPS through the CLI, IDM, IME, CSM, ASDM, or through another
application using SDEE.
•
Retrieve information
You can retrieve data (status messages, errors, and alerts) from the system through the CLI, IDM,
IME, CSM, ASDM, CS MARS or an other application using SDEE.
For More Information
For detailed information about SDEE, see SDEE, page A-33.
Security Features
Cisco IPS has the following security features:
•
Network access is restricted to hosts who are specificall y allowed access.
•
All remote hosts who attempt to connect through the web server, SSH and SCP or Telnet will be
authenticated.
•
By default Telnet access is disabled. You can choose to enable Telnet.
•
By default SSH access is enabled.
•
An FTP server does not run on the sensor. You can use SCP to remotely copy files.
•
By default the web server uses TLS or SSL. You can choose to disable TLS and SSL.
•
Unnecessary services are disabled.
•
Only the SNMP set required by the Cisco MIB Police is allowed within the CISCO-CIDS-MIB.
OIDs implemented by the public domain SNMP agent will be writeable when specified by the MIB.
For More Information
For detailed information about SNMP and Cisco MIBs, see Chapter 15, “Configuring SNMP.”