Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 234 / 588

7-8
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 7 Configuring Host-Based IDS and IPS Devices
Cisco Security Agent 4.x Device
Add a CSA Agent Manually
You can manually add a CSA Agent as a child of the CSA MC. This feature allows you to represent all
of your agents, even if they have not generated any notifications.
To add CSA agents manually, follow these steps:
Step 1
Click Admin > Security and Monitoring Devices .
Step 2 From the list of devices, select the host running Cisco CSA Management Center, and click Edit .
Step 3
Click the Reporting Applications tab, select Cisco CSA Management Center in the Device Type list,
and click Edit .
Step 4
Click the Add Agent .
Step 5
Do one of the following:
• Select the existing device, click Edit Existing , and continue with Step 8 .
A page displays with the values pre-populated for hostname, reporting IP address, and at least one
interface.
• Click Add New , and continue with Step 6 .
Step 6 In the Device Name field, enter the hostname on which this CSA agent resides.
This value should reflect the DNS entry for this device.
Step 7 In the Reporting IP field, enter the IP address that the agent uses to send logs to the CSA MC.
Step 8
Define each interface that is configured for this host by specifying the interface name, IP address, and
network mask. To add a new interface, click
Add Interface .
The interface settings are used for attack path calculation. It is very important that you identify any
dual-homed hosts by defining each interface.
Step 9
Click Submit , and then click Done .
Step 10 To activate this device, click Activate .