Информационное Руководство для Cisco Cisco ACE Application Control Engine Module

Important notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com.

Page 8 of 10

How is the Cisco AVS Web Application Firewall different from an intrusion prevention system (IPS)?

IPSs are solid solutions for protecting against attacks targeted at known vulnerabilities in major platforms such as Windows, Solaris, Apache,

or Microsoft Internet Information Services (IIS). Cisco AVS excels at protecting against attacks targeted at business applications or Websites. These

applications might be software vendor-built applications or in-house custom applications. Security patches and signatures are typically not available

for these types of applications, and building these levels of security into each application would be nearly impossible.

How is the Cisco AVS Web Application Firewall different from a network firewall?

The Cisco AVS 3120 and network firewalls such as the Cisco PIX

Firewall and Cisco ASA 5500 Series Adaptive Security Appliances are

complementary products. The Cisco AVS Web Application Firewall secures Web-based applications; network firewalls excel at securing networks;

and the Cisco AVS provides defense in depth for Web applications.

Network firewalls enforce policy on networks, IP addresses, and ports; they have a broad set of application layer features for many different

protocols. The firewall can and will be deployed in many locations, including branch, network edge, enterprise edge, etc. The Cisco AVS enforces

policy on HTTP data such as URLs, headers, and parameters. The Cisco AVS is deployed only in the data center in front of Web applications.

Can you tell me about the various Cisco AVS 3100 Series Application Velocity System appliances?

Cisco originally shipped the Cisco AVS 3110 Application Velocity System. The Cisco AVS 3110 appliance product was the result of the

Cisco Systems acquisition of Fineground Networks. The latest version of software supporting that appliance was Fineground Version 5.0 software.

This appliance-based product had “Fineground Networks” logos, documentation splash screens, colors, etc.

The Cisco AVS 3120 and AVS 3180 are appliances built by Cisco with Cisco logos, documentation splash screens, colors, etc. These appliances

replace the Cisco AVS 3110 appliance.

The Cisco AVS 3120 is an inline appliance for improving Web application performance and providing Web application security. The Cisco AVS

3180 Management Station is an optional appliance-based management console for configuring and managing Cisco AVS 3120 appliances. The

Cisco AVS 3180 is also required if customers require the Cisco AVS AppScope Monitor performance monitoring capability. The Cisco AVS 3120

has an embedded device manager and does not require the Cisco AVS 3180 for configuration.

Which appliances support Cisco AVS 6.0 versions of software?

Cisco AVS 6.0 software is not supported on the Cisco AVS 3110 hardware. Customers must upgrade to the Cisco AVS 3120 hardware to run

Cisco AVS 6.0 software.

The optional Cisco AVS 3180 Management Station must be upgraded to Cisco AVS 6.0 Management Station software to manage a Cisco AVS 3120

appliance with Cisco AVS 6.0 software. A Cisco AVS 3180 Management Station with Cisco AVS 6.0 Management Station software requires that

all Cisco AVS 3120 hardware run Cisco AVS 6.0 software. A mixed environment of Cisco AVS 5.0 and AVS 6.0 software cannot be managed

with a Cisco AVS 3180. A Cisco AVS 3180 Management Station with Cisco AVS 6.0 software will not manage a Cisco AVS 3110 with any

version of software.

Is the current Cisco AVS 5.0 AppScreen Web Application Firewall function still available in Cisco AVS Version 6.0 software?

Yes, the AppScreen feature set is still available with the Cisco AVS 6.0 software. AppScreen and the new Web application security features

are different software modules, and they provide some similar feature sets. It is expected that AppScreen features will be removed from the software

in the next major release of AVS software, as people begin to understand the replacement-configurable parameters within the new Web application

security module.