A-12
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
MainApp
Figure A-3 shows the transactionHandlerLoop method in the CtlTransSource.
Figure A-3 CtlTransSource
When the transactionHandlerLoop receives a remotely addressed transaction, it tries to forward the
remote control transaction to its remote destination. The transactionHandlerLoop formats the transaction
into a control transaction message. The transactionHandlerLoop uses the HttpClient classes to issue the
control transaction request to the HTTP server on the remote node. The remote HTTP server handles the
remote control transaction and returns the appropriate response message in an HTTP response. If the
remote HTTP server is an IPS web server, the web server uses the CtlTransSource servlet to process the
remote control transactions.
The transactionHandlerLoop returns either the response or a failure response as the response of the
control transaction to the initiator of the remote control transaction. If the HTTP server returns an
unauthorized status response (indicating the HTTP client has insufficient credentials on the HTTP
server), the transactionHandlerLoop reissues the transaction request using the designated username and
password of the CtlTransSource to authenticate the identity of the requestor. The
transactionHandlerLoop continues to loop until it receives a control transaction that directs it to exit or
until its exit event is signaled.
Attack Response Controller
This section describes the ARC, which is the IPS application that starts and stops blocking on routers,
switches, and firewalls, and rate limits traffic on routers running Cisco IOS 12.3. A block is an entry in
the configuration or ACL of a device to block incoming and outgoing traffic for a specific host IP address
or network address. This section contains the following topics:
•
Understanding the ARC, page A-13
•
ARC Features, page A-14
•
Supported Blocking Devices, page A-15
•
ACLs and VACLs, pageA-16
•
Maintaining State Across Restarts, page A-16
•
Connection-Based and Unconditional Blocking, page A-17
•
Blocking with Cisco Firewalls, page A-18
•
Blocking with Catalyst Switches, page A-19
119595
IDAPI HTTP Client
CtlTransSource
+CtlTransSource0
+transaction HandlerLoop