A-35
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix A System Architecture
Summary of Cisco IPS Applications
•
/usr/cids/idsRoot/bin—Contains the binary executables.
•
/usr/cids/idsRoot/bin/authentication—Contains the authentication application.
•
/usr/cids/idsRoot/bin/cidDump—Contains the script that gathers data for tech support.
•
/usr/cids/idsRoot/bin/cidwebserver—Contains the web server application.
•
/usr/cids/idsRoot/bin/cidcli—Contains the CLI application.
•
/usr/cids/idsRoot/bin/nac—Contains the ARC application.
•
/usr/cids/idsRoot/bin/logApp—Contains the logger application.
•
/usr/cids/idsRoot/bin/mainApp—Contains the main application.
•
/usr/cids/idsRoot/bin/sensorApp—Contains the sensor application.
•
/usr/cids/idsRoot/bin/collaborationApp—Contains the collaboration application.
•
/usr/cids/idsRoot/bin/switchApp—Contains the switch application.
•
/usr/cids/idsRoot/etc—Stores sensor configuration files.
•
/usr/cids/idsRoot/htdocs—Contains the IDM files for the web server.
•
/usr/cids/idsRoot/lib—Contains the library files for the sensor applications.
•
/usr/cids/idsRoot/log—Contains the log files for debugging.
•
/usr/cids/idsRoot/tmp—Stores the temporary files created during run time of the sensor.
Summary of Cisco IPS Applications
Tabl e A-2 gives a summary of the applications that make up the IPS.
TableA-2 Summary of Applications
Application Description
AuthenticationApp Authorizes and authenticates users based on IP a ddress, password,
and digital certificates.
Attack Response Controller An ARC is run on every sensor. Each ARC subscribes to network
access events from its local Event Store. The ARC configuration
contains a list of sensors and the network access devices that its local
ARC controls. If an ARC is configured to send network access events
to a master blocking sensor, it initiates a network access control
transaction to the remote ARC that controls the device. These
network access action control transactions are also used by IPS
managers to issue occasional network access actions.
CLI Accepts command line input and modifies the local configuration
using the IDAPI.
CollaborationApp Shares information with other devices through a global correlation
database to improve the combined efficacy of all the devices.
Control Transaction Server
1
Accepts control transactions from a remote client, initiates a local
control transaction, and returns the response to the remote client.
Control Transaction Source
2
Waits for control transactions directed to remote applications,
forwards the control transactions to the remote node, and returns the
response to the initiator.