Configuring a Cisco Secure IDS Sensor in CSPM

Introduction

This document explains the procedure used to configure a Cisco Secure Intrusion Detection System (IDS) Sensor on Cisco Secure Policy Manager (CSPM). This document assumes that you have installed CSPM version 2.3.I on your computer. Version "I" allows management of IDS devices (appliance Sensors, Cisco IOS^® routers, or IDS Blades) in a Cisco Catalyst^® 6000 switch. This document also assumes that the IDS postoffice parameters are correctly defined. These include HOSTID, ORGID, HOSTNAME, and ORGNAME. Please note that for the CSPM host to communicate with a Sensor, the ORGID and ORGNAME must match what is defined on the Sensor.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on CSPM 2.3.I and later.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Configuration

These sections explain the process used to configure an IDS sensor in CSPM.

Launch CSPM and log in. A blank template appears (initial launch) that allows you to define your network.

These three definitions are required in the CSPM topology for IDS.

1. Define the network in which the control interface of the Sensor resides and the network in which the CSPM host resides. If they are on the same subnet, then only one network needs to be defined. Define this network first.

2. Define the CSPM host in its network. Without the CSPM host definition, the Sensor cannot be managed.

3. Define the Sensor in its network.

Define the Network on Which the CSPM Host Resides

Complete these steps:

1. Right-click on the Internet icon in the topology and select New > Network to create a new network.

   

2. On the right hand side of the Network Panel, add the name of the new network, the network address, and the netmask that will be used.

   

3. Click the IP Address button, and enter the IP address for your network that it uses to reach the Internet.

   Normally it is the Default Gateway for the network.

   Note: When you manage Sensors, the gateway address does not necessarily have to be correct since the Sensor is not sent this default gateway information. It should already be defined in the Sensor.

4. Click OK. The network is added to the topology map without any errors.

   

Add the CSPM Host

Use this procedure to add the CSPM host.

1. In the Network Topology, right-click on the network you just added and select New > Host.

   CSPM brings up a screen similar to this. If not, then the network you just defined is not the network in which your CSPM host is located. Check the IP address on your CSPM host again.

   

2. Click Yes to install the CSPM host into the topology.

3. Verify that the information on the General screen for the CSPM host is ok.

4. Click OK on the General screen of the CSPM host.

Add the Sensor Device

Use this procedure to add the Sensor device.

1. Right-click on the network in which your Sensor resides and select Wizards > Add Sensor.

   Note: If the CSPM host and the control interface of your Sensor are not in the same network, define the network in which your Sensor resides.

   

2. Enter the correct postoffice parameters for the Sensor.

   

3. Click the Check here to verify the Sensor's address box.

   Note: If this is the first time you are setting up this Sensor, you do not want to capture the Sensor's configuration. If you have previously configured this Sensor elsewhere either via a UNIX director or another CSPM host and have made configuration changes to the Sensors signatures, then you want to capture the Sensor's configuration.

4. Click Next to define the signature versions on the Sensor. You can also issue the nrvers command to check this on the Sensor.

   

   Note: If CSPM does not have the correct Sensor version that you are running on your Sensor, update the signatures on your CSPM host. Please see Software Download (registered customers only) for updates.

5. Click the Next button to continue.

6. Click Finish to complete the installation of the Sensor into the topology.

7. From the main CSPM menu, select File > Save and Update to compile the information entered in the topology into CSPM. Please note that this step is necessary to start the postoffice protocol on the CSPM host.

8. Verify that everything works by logging into your Sensor as the netrangr user.

9. Execute the nrconns command.

   >nrconns
   
   Connection Status for gacy.rtp
   
                  cspm.rtp Connection 1: 172.18.124.106   45000 1 
                  [Established]  sto:0004 with Version 1
   
   netrangr@gacy:/usr/nr
   
   >

   Note: If the Sensor and CSPM host are not communicating, output similar to this appears instead:

   netrangr@gacy:/usr/nr
   
   >nrconns
   
   Connection Status for gacy.rtp
   
             insane.rtp Connection 1: 172.18.124.194   45000 1 [SynSent]      
             sto:5000  syn NOT rcvd!
   
                  
   
   netrangr@gacy:/usr/nr

   If this is the case, get a sniffer trace to see if both sides are sending UDP 45000 packets. UDP 45000 is what IDS devices use to communicate with each other. To test this on the Sensor, su to root and (depending on what Sensor you have) execute snoop -d iprb1 port 45000 (for an IDS 4210 Sensor) and snoop -d iprb0 port 45000 (for any other model of Sensor).

   Use <control-c> to break out of a snoop session.

   This output appears if there is no communications between the Sensor and CSPM:

   netrangr@gacy:/usr/nr
   
   >su -
   
   Password:
   
   Sun Microsystems Inc.   SunOS 5.8       Generic February 2000
   
   # snoop -d spwr0 port 45000
   
   Using device /dev/spwr (promiscuous mode)
   
     172.18.124.100 -> 172.18.124.106 UDP D=45000 S=45000 LEN=52
   
     172.18.124.100 -> 172.18.124.106 UDP D=45000 S=45000 LEN=52
   
     172.18.124.100 -> 172.18.124.106 UDP D=45000 S=45000 LEN=52
   
     172.18.124.100 -> 172.18.124.106 UDP D=45000 S=45000 LEN=52
   
   ^C#

   In the above output, the Sensor sends UDP 45000 packets, but does not receive any. A correct configuration produces output similar to this:

   # snoop -d spwr0 port 45000
   
   Using device /dev/iprb (promiscuous mode)
   
   172.18.124.106 -> gacy         UDP D=45000 S=45000 LEN=56
   
           gacy -> 172.18.124.106 UDP D=45000 S=45000 LEN=56
   
   172.18.124.142 -> gacy         UDP D=45000 S=45000 LEN=56
   
           gacy -> 172.18.124.194 UDP D=45000 S=45000 LEN=56

   In the above output, UDP 45000 traffic goes in both directions.

   If UDP 45000 packets flow in both directions and the output of nrconns on the Sensor still says that there is no connection established, the postoffice parameters on the Sensor and the CSPM host do not match.

   To check the postoffice parameters on the CSPM host manually:

   1. Use Windows Explorer to navigate to where you have CSPM installed on the NT machine.

      

   2. Edit the host, route, and organization files with Write or Wordpad (do not use Notepad because the formatting will be corrupted).

   3. Ensure that these files look correct for your installation. If any of the values are not correct, edit them and reboot your NT computer using these steps:

      1. Click on the CSPM icon in the network topology.

      2. Click on the Policy Distribution tab to enter your postoffice parameters.

      3. Save and Update your changes.

      4. Reboot the NT computer.

         

Configure the Sensor

After the configuration is saved in CSPM, configure the Sensor. In order to do this, first set the Sensor to write the alarms that it sees to its own log. Then set the Sensor to "sniff" on the correct interface.

Write Alarms to the Log

Use this procedure to write alarms to the log.

1. Click the Generate audit event log files box to tell the Sensor to send the alarms to its local logs.

   It also sends alarms to the CSPM box by default after you push a configuration down to it.

   

2. Click OK to continue.

Set the Sensor to "Sniff"

Use this procedure to set the Sensor to "Sniff".

1. Select the Sensor in your CSPM topology and click the Sensing tab.

2. Define the Packet Capture Device:

   • iprb0 - for an IDS 4210 Sensor

   • spwr0 - for any other Sensor model

   

3. Click OK to continue.

4. Click the Update icon on the CSPM menu bar to update CSPM with the information.

   Note: If everything goes well, a screen similar to this appears. Notice there are no red errors. Yellow warnings are typically ok.

   

5. Select the Sensor in the network topology and click the Command tab to send the updated configuration to the Sensor.

   

6. Click the Approve Now button to send the configuration to the Sensor.

   

   The Status pane displays the "Upload <#> completed" message. This indicates a valid and complete transfer process. The Sensor is now updated and should now run normally.

   If the Sensor is not running normally, go back to the Sensor and check the output of the nrconns command to make sure that the connection between the CSPM host and the Sensor is established.

   

   After this is complete, you can look for alarms that the Sensor sends to the CSPM host in the event viewer. To view the event viewer, from the CSPM main menu select Tools > View Sensor Events > Database.

   

   Click OK to display the events database window. Your screen will vary depending on the alarms that you may be getting.

   

Related Information

• Technical Support & Documentation - Cisco Systems