A-17
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
MainApp
The following scenarios demonstrate how the ARC maintains state across restarts.
Scenario 1
There are two blocks in effect when the ARC stops and one of them expires before the ARC restarts.
When the ARC restarts, it first reads the nac.shun.txt file. It then reads the preblock and postblock ACLs
or VACLs. The active ACL or VACL is built in the following order:
1.
The allow sensor_ ip_address command (unless the allow sensor shun command has been
configured)
2.
Preblock ACL
3.
The always block command entries from the configuration
4.
Unexpired blocks from nac.shun.txt
5.
Postblock ACL
When a host is specified as never block in the ARC configuration, it does not get translated into permit
statements in the ACL. Instead, it is cached by the ARC and used to filter incoming addShunEvent events
and addShunEntry control transactions.
Scenario 2
There are no preblock or postblock ACLs specified, but there is an existing active ACL. The new ACL
is built in the following order:
1.
The allow sensor_ ip_address command (unless the allow sensor shun command has been
configured)
2.
The always block command entries from the configuration
3.
Unexpired blocks from nac.shun.txt
4.
The permit IP any any command
Connection-Based and Unconditional Blocking
The ARC supports two types of blocking for hosts and one type of blocking for networks. Host blocks
are connection-based or unconditional . Network blocks are always unconditional.
When a host block is received, the ARC checks for the connectionShun attribute on the host block. If
connectionShun is set to true, the ARC performs connection blocking. Any host block can contain
optional parameters, such as destination IP address, source port, destination port, and protocol. For a
connection block to take place, at least the source and destination IP ad dress must be present. If the
source port is present on a connection block, it is ignored and not included in the block.
Under the following conditions, the ARC forces the block to be unconditional, converting the block from
connection type if necessary:
•
A block of any type is active for a specified source IP address
•
A new block of any type is received for that source IP address
•
The new block differs in any of its optional parameters (except the source port) f rom the old block
When a block is updated (for example, when a new block arrives while an existing block for that source
IP address or network is already in effect), the remaining minutes of the existing block are determined.
If the time for the new block is less than or equal to the remaining minutes, no action is taken. Otherwise,
the new block timeout replaces the existing block timeout.