Cisco Cisco Security Monitoring, Analysis and Response System 3.3 Guide D’Information
All contents are Copyright © 1992–2006 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 2 of 8
3.
Cisco Security MARS 50 can sustain 1000 events per second and 25,000 NetFlow flows per second.
4.
Cisco Security MARS 100e can sustain 3000 events per second and 75,000 NetFlow flows per second.
5.
Cisco Security MARS 100 can sustain 5000 events per second and 150,000 NetFlow flows per second.
6.
Cisco Security MARS 200 can sustain 10,000 events per second and 300,000 NetFlow flows per second.
Note:
The NetFlow numbers indicate flows per second, not packets per second. The numbers stated are over a sustained rate; the
system can manage peaks that exceed these numbers.
Q.
What happens if the rate of events per second is higher than the rate supported?
A.
If the load of events is higher that what the system supports, a queue prioritizes the events that will be processed, and the lower-
severity events are dropped while higher-severity events are still processed.
The rate of events supported officially by the system is for a sustained period of time. If the peak exceeds those numbers, the events
will not be dropped. Cisco Security MARS has a strong capacity to sustain high peaks of events per second during a network attack.
Q.
Do I need extra licenses besides the appliance?
A.
All required components and licenses are included in the list price.
Q.
If I have multiple Cisco Security MARS appliances, is there a recommended deployment architecture?
A.
The Cisco Security MARS Global Controller provides a central console for multiple-box solutions. In the Global Controller
architecture, the Local Controller forwards summarized data to the Global Controller where the combined “zones” (topology,
incidents, etc.) are displayed. All administrative access and control can be performed from the Global Controller.
A standalone solution is for customers who have all their devices locally in one geographical location or who do not mind inundating
their WAN links with Syslog, NetFlow, and Simple Network Management Protocol (SNMP) data. For geographically distributed sites
and instances where customers do not want to flood their WAN links, customers should consider the distributed solution.
Q.
What is a zone?
A.
A zone is an area of a customer network related to one Local Controller. Each Local Controller represents a specific zone.
Q.
Is the appliance secured?
A.
The Cisco Security MARS appliance comes security-hardened. All unnecessary services such as Simple Mail Transfer Protocol
(SMTP) have been removed.
DEVICE SUPPORT
Q.
What is the list of supported devices in Cisco Security MARS?
A.
The complete list of supported devices is available at:
http://www.cisco.com/en/US/products/ps6241/products_device_support_tables_list.html
.
Q.
What is the best way to add my devices and configure the network?
A.
There are different ways to add devices to Cisco Security MARS:
●
From seed file
●
Manually, one by one
●
Using a discovery process
For more details on how to build the seed file, how to add single devices, and how to discover devices, see “Adding Reporting and
Mitigation Devices” at:
http://www.cisco.com/en/US/products/ps6241/products_user_guide_chapter09186a008075038a.html
.