Cisco Systems IPS4510K9 Understanding the AIC Engine, AIC Engine and Sensor Performance, AIC Engine Parameters

B-11
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Appendix B Signature Engines
AIC Engine
Understanding the AIC Engine
AIC provides thorough analysis of web traffic. It provides granular control over HTTP sessions to
prevent abuse of the HTTP protocol. It allows administrative control over applications, such as instant
messaging and gotomypc, that try to tunnel over specified ports. Inspection and policy checks for P2P
and instant messaging are possible if these applications are running over HTTP. AIC also provides a way
to inspect FTP traffic and control the commands being issued. You can enable or disable the predefined
signatures or you can create policies through custom signatures.
Note The AIC engines run when HTTP traffic is received on AIC web ports. If traffic is web traffic, but not
received on the AIC web ports, the Service HTTP engine is executed. AIC inspection can be on any port
if it is configured as an AIC web port and the traffic to be inspected is HTTP traffic.
AIC Engine and Sensor Performance
Application policy enforcement is a unique sensor feature. Rather than b eing based on traditional IPS
technologies that inspect for exploits, vulnerabilities, and anomalies, AIC policy enforcement is
designed to enforce HTTP and FTP service policies. The inspection work required for this policy
enforcement is extreme compared with trad itional IPS inspection work. A large performance penalty is
associated with using this feature. When AIC is enabled, the overall bandwidth capacity of the sensor is
reduced.
AIC policy enforcement is disabled in the IPS default configuration. If you want to activate AIC policy
enforcement, we highly recommend that you carefully choose the exact policies of interest an d disable
those you do not need. Also, if your sensor is near its maximum inspec tion load capacity, we recommend
that you not use this feature since it can oversubscribe the sensor. We recommend that you use the
adaptive security appliance firewall to handle this type of policy enforcement.
AIC Engine Parameters
The AIC engines define signatures for deep inspection of web traffic. They also define signatures that
authorize and enforce FTP commands. There are two AIC engines: AIC HTTP and AIC FTP. The AIC
engines have the following features:
• Web t raf fic:
– RFC compliance enforcement
– HTTP request method authorization and enforcement
– Response message validation
– MIME type enforcement
– Transfer encoding type validation
– Content control based on message content and type of data being transferred
– URI length enforcement
– Message size enforcement according to policy configured and the header
– Tunneling, P2P and instant messaging enforcement.
This enforcement is done using regular expressions. There are predefined signature but you can
expand the lis t.