Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 198 / 588

6-8
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 6 Configuring Network-based IDS and IPS Devices
Cisco IDS 4.0 and IPS 5.x Sensors
Step 5
Enter the administrative IP address in the Reporting IP field.
The Reporting IP address is the same address as the administrative IP address.
Step 6
In the Login field, enter the username associated with the administrative account that will be used to
access the reporting device.
Step 7 In the Password field, enter the password associated with the username specified in the Login field.
Step 8
In the Port field, enter the TCP port on which the webserver running on the sensor listens. The default
HTTPS port is 443.
Note
While it is possible to configure HTTP only, MARS requires HTTPS.
Step 9
To pull the IP logs from the sensor, select Yes in the Pull IP Logs box.
Step 10
For attack path calculation and mitigation, specify the networks being monitored by the sensor. Do one
of the following:
To manually define the networks, select the Define a Network radio button.
a. Enter the network address in the Network IP field.
b.
Enter the corresponding network mask value in the Mask field.
c. Click Add to move the specified network into the Monitored Networks field.
d.
Repeat as needed.
To select the networks that are attached to the device, click the Select a Network radio button.
a.
Select a network from in the Select a Network list.
b. Click Add to move the selected network into the Monitored Networks field.
c.
Repeat as needed.
Step 11 To verify the configuration, click Test Connectivity .
Step 12
Click Submit .
Specify the Monitored Networks for Cisco IPS or IDS Device Imported from a
Seed File
After you import a Cisco IPS or IDS device into MARS using a seed file, you must define the networks
that are monitored by that sensor.
To define the networks monitored by a sensor, follow these steps:
Step 1 Click Admin > System Setup > Security and Monitor Devices.
Step 2
Select the check box next to the Cisco IPS or IDS device that was imported using a seed file. and click
Edit .
Step 3 To specify the networks being monitored by the sensor, do one of the following:
To manually define the networks, select the Define a Network radio button.
a. Enter the network address in the Network IP field.
b.
Enter the corresponding network mask value in the Mask field.