Table of Contents
Advertisement
Cisco IDS 4.0 and IPS 5.x Sensors
Enter the administrative IP address in the Reporting IP field.
Step 5
The Reporting IP address is the same address as the administrative IP address.
In the Login field, enter the username associated with the administrative account that will be used to
Step 6
access the reporting device.
In the Password field, enter the password associated with the username specified in the Login field.
Step 7
In the Port field, enter the TCP port on which the webserver running on the sensor listens. The default
Step 8
HTTPS port is 443.
While it is possible to configure HTTP only, MARS requires HTTPS.
Note
To pull the IP logs from the sensor, select Yes in the Pull IP Logs box.
Step 9
Step 10
For attack path calculation and mitigation, specify the networks being monitored by the sensor. Do one
of the following:
To manually define the networks, select the Define a Network radio button.
a.
b.
c.
d.
To select the networks that are attached to the device, click the Select a Network radio button.
a.
b.
c.
Step 11
To verify the configuration, click Test Connectivity.
Click Submit.
Step 12
Specify the Monitored Networks for Cisco IPS or IDS Device Imported from a
Seed File
After you import a Cisco IPS or IDS device into MARS using a seed file, you must define the networks
that are monitored by that sensor.
To define the networks monitored by a sensor, follow these steps:
Click Admin > System Setup > Security and Monitor Devices.
Step 1
Select the check box next to the Cisco IPS or IDS device that was imported using a seed file. and click
Step 2
Edit.
To specify the networks being monitored by the sensor, do one of the following:
Step 3
To manually define the networks, select the Define a Network radio button.
a.
b.
User Guide for Cisco Security MARS Local Controller
6-8
Enter the network address in the Network IP field.
Enter the corresponding network mask value in the Mask field.
Click Add to move the specified network into the Monitored Networks field.
Repeat as needed.
Select a network from in the Select a Network list.
Click Add to move the selected network into the Monitored Networks field.
Repeat as needed.
Enter the network address in the Network IP field.
Enter the corresponding network mask value in the Mask field.
Chapter 6
Configuring Network-based IDS and IPS Devices
78-17020-01
- Quick Links:
- Table of Contents
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
