A-22
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
SensorApp
Each TLS client has different procedures for establishing this trust. The sensor itself includes a TLS
client that is used to send control transactions to other sensors and download upgrades and configuration
files from other TLS web servers. Use the tls trusted-host command to establish trust of the TLS servers
with which the sensor communicates.
Similarly, the sensor includes an SSH client that is used to communicate with managed network devices,
download upgrades, and copy configurations and support files to remote hosts. Us e the ssh host-key
command to establish trust relationships with the SSH servers the sensor will contact.
You can manage the list of TLS trusted certificates and SSH known hosts through the commands service
trusted-certificates and service ssh-known-hosts.
X.509 certificates include additional information that can increase the security of the trust relationship;
however, these can lead to confusion. For example, an X.509 certificate includes a validity period during
which the certificate can be trusted. Typically this period is a number of years starting at the moment the
certificate is created. To ensure that an X.509 certificate is valid at the moment it is being used requires
that the client system maintain an accurate clock.
X.509 certificates are also tied to a particular network address. Sensors fill this field with the IP address
of the command and control interface of the sensor. Consequently, if you change the command and
control IP address of the sensor, the X.509 certificate of the server is regenerated. You must reconfigure
all clients on the network that trusted the old certificate to locate the sensor at its new IP address and
trust the new certificate.
By using the SSH known hosts and TLS trusted certificates services in the AuthenticationApp, you can
operate sensors at a high level of security.

Web Server

The web server provides SDEE support, which enables the sensor to report security events, receive
IDIOM transactions, and serve IP logs. The web server supp orts HTTP 1.0 and 1.1. Communications
with the web server often include sensitive information, such as passwords, that would severely
compromise the security of the system if an attacker were able to eavesdrop. For this reason, sensors ship
with TLS enabled. The TLS protocol is an encryption protocol that is compatible with SSL.
Note
We deprecated the RDEP event sever service in IPS 6.1, and deleted it from the IPS 7.0(1) system
architecture. The web server now uses the SDEE event server.
SensorApp
This section describes the SensorApp, and contains the following topics:
•
Understanding the SensorApp, page A-23
•
Inline, Normalization, and Event Risk Rating Features, page A-24
•
SensorApp New Features, page A-25
•
Packet Flow, pageA-25
•
Signature Event Action Processor, page A-26