Cisco Cisco IPS 4255 Sensor Guia De Informação
The Cisco Incident Control System includes embedded software and support from Trend Micro.
Point of sale and registration data will be provided to both Cisco and Trend Micro.
© 2005 Cisco Systems, Inc. All rights reserved.
Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.
Page 4 of 8
Q.
What are the various response actions that can be configured on Cisco IPS appliances?
A.
Multiple automated response actions include packet drops, connection termination, access control list (ACL) blocking on routers, switches,
and firewalls, generation of SNMP traps, and IPS session logging.
Q.
What types of packet-drop actions are available with the inline IPS services delivered with Cisco IPS Sensor Software Version 5.0?
A.
Cisco IPS Sensor Software Version 5.0 delivers numerous packet-drop actions, including dropping the trigger packet, dropping the entire
flow (that contains the trigger packet), and dropping all packets from the attacker's source IP address.
Q.
Can multiple response actions be performed simultaneously?
A.
Yes. At times (depending on the type of threat, deployment scenario, and other criteria), multiple response actions may be configured to
result in effective worm and virus containment.
Q.
How does a Cisco IPS Version 5.0 sensor react to sensor software failure?
A.
Since the IPS sensors are inline such that packets flow through the sensor, the IPS sensors must support high-availability features to ensure
business continuity. Cisco IPS Sensor Software Version 5.0 delivers automated fail-open mechanisms that will allow the sensor to pass packets
despite sensor software failure.
Q.
Will the fail-open capability operate if a hard disk fails on a sensor?
A.
Yes. The sensor can be configured to operate in fail-open mode in the event of a hard disk failure.
Q.
Can this fail-open feature be manually configured?
A.
The sensor can be manually put into fail open mode for troubleshooting or testing purposes.
Q.
How can my existing networking infrastructure add reliability to my IPS deployment?
A.
IPS appliances allow network redundancy through the use of spanning tree resolution. Because IPS devices act as layer two bridges, connecting
two or more between the same set of switches will allow the switch to determine the correct path to send packets to.
Q.
What mechanisms are available to monitor the health of IPS sensors?
A.
Cisco IPS Sensor Software Version 5.0 supports Simple Network Management Protocol (SNMP) to deliver alarm information through SNMP
traps. SNMP can also be used to query the sensor for critical sensor statistics and health. Sensor health information can also be obtained at the
management console.
Q.
How can I integrate IPS services into my network infrastructure?
A.
Cisco IPS Sensor Software Version 5.0 delivers the industry's first IPS solution that is integrated into Cisco Catalyst switches, with the IDSM-2
module that can be deployed in inline IPS mode.
ACCURATE PREVENTION TECHNOLOGIES
Q.
What is accurate prevention technology, being delivered by Cisco IPS Sensor Software Version 5.0?
A.
Traditional IPS devices have been prone to generating false alarms. Packets that are dropped based on false alarms can result in network
disruption if the dropped packets are required for mission-critical applications downstream of the IPS sensor. The cornerstone of Cisco IPS Sensor
Software Version 5.0 minimizing false alarms, such that users can gain a high level of confidence when dropping packets in IPS mode, thereby
ensuring business continuity. Crucial features such as Risk Rating and Meta-Event Generator (MEG) allow users to make intelligent decisions
when performing IPS drop actions.
Q.
What are the main benefits of Risk Rating?
A.
Risk Rating provides the user with an indication of the relative risk of the traffic or offending host continuing to access the user's network. This
rating can be used either to illuminate the events that require immediate administrator or to provide a means for developing risk-oriented event
action policies. The Risk Rating is a calculated number that has four primary components-alert severity rating, signature fidelity rating, attack