Table Of Contents
Reporting and Mitigation Devices
Hardware Descriptions—MARS 110R, 110, 210, GC2R, and GC2
Part Numbers, License Key, and Serial Numbers
Removing and Replacing the Front Bezel
Control Panel LED Descriptions
Redundant Power Supply Descriptions
Checking Power Supply Operational Status
Appliance Overview
Revised: May 9, 2007, OL-13543-01This chapter defines components of the Cisco Security Monitoring, Analysis, and Response System (MARS) and describes the front and backplanes of the various appliance models. This chapter contains the following sections:
•
Hardware Descriptions—MARS 110R, 110, 210, GC2R, and GC2
System Description
Cisco Security MARS is a security threat mitigation (STM) system. It delivers a range of information about your networks' health as reported by devices in your networks. It processes raw events from your reporting devices, sessionizes1 them across different devices, evaluates for matching inspection rules (system and user-defined), identifies false positives, and consolidates information using diagrams, charts, queries, reports, and rules.
MARS helps you be more productive by:
•
•
•
•
The MARS system operates at distinct and separate levels based on how much information is provided about your networks' reporting devices. At its most basic level, MARS functions as a syslog server. As you add information about reporting devices, MARS begins to sessionize the raw data, and after you configure additional reporting devices and enable the more verbose reporting features, it presents a much more comprehensive view of your network, from which you can quickly drill-down to a specific MAC address, for example.
Figure 1-1 presents an example deployment of MARS, which identifies the components of the system and their relationships.
Figure 1-1 Relationship of Global Controller to Local Controller to Reporting/Mitigation Device
The Cisco Security MARS system comprises the following components:
•
Local Controller
The Local Controller models are as follows— MARS 110R, MARS 110, and MARS 210. Each model differs in its ability to process and store events from reporting devices, enabling you to accurately address your needs based on the size of your network and the traffic volume.
Local Controllers receive and pull data from reporting devices, such as firewalls, routers, intrusion detection/prevention systems, and vulnerability assessment systems. Based on the data obtained from those devices, and the level of integration with them, MARS can present you with suggested mitigation rules for detected attacks and, in some cases, push those rules to the mitigation device, which is a network device that contains the attack by restricting network access to the infected hosts.
A Local Controller summarizes information about the health of your network based on data it receives from the reporting devices that it monitors.
The Local Controller performs the following functions:
•
•
•
•
•
•
•
•
Global Controller
If you deploy numerous Local Controllers, you can deploy a Global Controller that summarizes the findings of two or more Local Controllers. In this way, the Global Controller enables you to scale your network monitoring without increasing the management burden. The Global Controller provides a single user interface for defining new device types, inspection rules, and queries, and it enables you to manage Local Controllers under its control. This management includes defining administrative accounts and performing remote, distributed upgrades of the Local Controllers. The Global Controller is available in the following models—MARS GC2 and MARS GC2R.
MARS Web Interface
The MARS web interface operates on a client computer. With many features common to both the Local Controller and Global Controller, the web interface uses a tabbed, hyperlinked, browser-based user interface. You access the web interface from any computer that can access the MARS Appliance on your network. For more information on client requirements, see Web Browser Client Requirements, page 3-10.
From the web interface, you can perform most of your administrative functions, including all functions that are not supported at the command line. Although this manual includes procedures for initially configuring the appliance using the web interface, the following publications reference their corresponding web interface:
•
•
Reporting and Mitigation Devices
If you consider the MARS system from a top-down perspective, you see that the Global Controller monitors Local Controllers and that Local Controllers monitor one or more reporting devices. Reporting devices provide MARS with data about the network, from traffic flows, as in the case of a router, to the configuration of possible attack targets, such as from a vulnerability assessment system.
A reporting device that can deny a traffic flow is called a mitigation device (for example, a switch). MARS provides mitigation support in two forms:
•
•
How you configure your reporting devices and mitigation devices greatly affects the ability of MARS to detect ongoing attacks. You can learn more about how to configure these devices in the following:
•
•
For a complete list of the supported reporting and mitigating devices, see:
•
Network Cable Requirements
The Ethernet connectors are designed for attaching an unshielded twisted pair (UTP) Ethernet cable equipped with standard RJ-45 compatible plugs. Press one end of the UTP cable into the Ethernet connector until the plug snaps securely into place. Connect the other end of the cable to an RJ-45 port on a hub or other device, depending on your network configuration. Observe the following cabling restrictions for 10BASE-T, 100BASE-TX, and 1000BASE-TX networks:
•
•
•
Hardware Descriptions—MARS 110R, 110, 210, GC2R, and GC2
The Cisco Security MARS 110R, 110, 210, GC2R, and GC2 appliances are built with the second generation of CS-MARS hardware, and operate with only CS-MARS software versions 5.X.
This section consists of the following subsections:
•
•
•
Technical Specifications
Table 1-1 summarizes chassis and component descriptions; Table 1-2 summarizes environmental and electrical descriptions.
Table 1-1 Chassis and Component Specifications for MARS 110R, 110, 210, GC2R, and GC2
Maximum Weight
29.5 kg (65 lbs)
29.5 kg (65 lbs)
Dimensions
2 Rack Units (2U)
Height: 87.3 mm (3.44 in)Width w/o rails: 430 mm (16.93 in)
Width with rails: 451.3 mm (17.77 in)Depth: 704.8 mm (27.75 in)
2 Rack Units (2U)
Height: 87.3 mm (3.44 in)Width w/o rails: 430 mm (16.93 in)
Width with rails: 451.3 mm (17.77 in)Depth: 704.8 mm (27.75 in)
Power Supplies
2 X 750W Redundant (1 + 1) ATX Hot-swappable
100-240 VAC 50-60Hz2 X 750W Redundant (1 + 1) ATX
Hot-swappable
100-240 VAC 50-60HzPower Consumption
11A maximum @110 VAC
5.5A maximum @ 220 VAC11A maximum @110 VAC
5.5A maximum @ 220 VACProcessor
Dual Intel Woodcrest Dual-Core Xeon 2.0 GHz (5130)
Dual Intel Woodcrest Dual-Core Xeon 3.0 GHz (5160)
Integrated Network Controller
Dual Intel 82563 EB 10/100/1000
PHYs supporting Intel I/O
Acceleration TechnologyDual Intel 82563 EB 10/100/1000 PHYs supporting Intel I/O Acceleration Technology
PCI NIC
Dual Port Intel Pro/1000 PT
Network ControllerDual Port Intel Pro/1000 PT
Network ControllerModem
US Robotics 56k V.92 Performance Pro Modem (USR5610B)
or
US Robotics 56k V.92 Performance Pro Modem (USR802972A-OEM)
US Robotics 56k V.92 Performance Pro Modem (USR5610B)
or
US Robotics 56k V.92 Performance Pro Modem (USR802972A-OEM)
Hard Drive Storage
1.5 TB RAID 10
Hot-swappable
Front accessible6 X 500 GB SATA-IO HDD,
Seagate Barracuda ES 3 TB3.0 Gbps, 7200 RPM, 16MB Buffer
2.0 TB1 RAID 10
Hot-swappable
Front accessible6 X 750 GB SATA-IO HDD,
Seagate Barracuda ES 3 TB3.0 Gbps, 7200 RPM, 16 MB Buffer
DVD-ROM
Slimline IDE DVD-ROM
Slimline IDE DVD-ROM
System battery
Lithium button cell
Lithium button cell
1 Although there is a total of 4.5 TB storage, RAID 10 has a maximum size configuration of 2 TB Redundant, or 4 TB total
Part Numbers, License Key, and Serial Numbers
The part numbers of Cisco Security MARS Appliances and the Field Replaceable Units (FRUs) that operate with software releases 5.X are as follows:
Local Controller Appliances
•
•
•
Global Controller Appliances
•
•
Serial Numbers
If you have difficulty identifying or physically locating the serial number sticker on your appliance chassis, use the Cisco Product Identification Tool at the following URL:
http://tools.cisco.com/Support/CPI/index.do
You must be registered with Cisco Systems Customer Connection Online to access this tool. If you are not registered, you can register at the following URL:
http://tools.cisco.com/RPF/register/register.do
The chassis, hard drive, and power supply serial numbers are also reported in the show inventory CLI command.
License Key
The license key sticker is on the chassis, and on the Recovery DVD case shipped with your product.
Removing and Replacing the Front Bezel
You must remove the front bezel to access the DVD ROM, hard drives, and control panel buttons on the control panel. The bezel does not lock.
To remove the bezel, pull the bezel from the appliance, as shown in Figure 2.
To replace the bezel, line up the center notch on the bezel with the center guide on the rack handles, then push the bezel onto the front of the MARS Appliance until it clicks into place.
Figure 2 Removing the Front Bezel
Front Panel Features
The front panel elements are shown in Figure 1-3 and described in the following subsections:
•
Figure 1-3 Front Panel of MARS 110R, 110, 210, GC2R, and GC2—with Bezel Removed
Rack Handles
Slim-Line DVD-ROM
Hard Drive Bays (5 total)
Flex Bay—MARS uses the Flex Bay as the 6th hard drive.
Standard Control Panel
Note
Note
Control Panel Description
The standard control panel supports several push buttons and status LEDs. Figure 1-4 shows the layout and functions of the control panel. The Universal Serial Bus (USB) port is not supported.
Figure 1-4 Control Panel Elements—MARS 110R, 110, 210, GC2R, and GC2
Control Panel LED Descriptions
Table 1-4 describes the function of control panel LEDs.
Table 1-4 Control Panel LED Explanations
NIC 1 or NIC 2 LED
2, 1
Steady Green—NIC has link
Blinking Green—NIC Activity
Power On/Off LED
4
Steady Green—Legacy power on
Blinking Green—Sleep state (not supported)
Off—Power is off.
System Identification LED
7
Note
Solid Blue—Blue identification LEDs are on
Off—Blue identification LEDs are off
System Status LED
6
Note
Alternating Green and Amber Blink—Pre-DC 5V standby power is on. There are 15-20 seconds of system initialization when AC is applied to the appliance. The control panel buttons are disabled until initialization is complete.
Solid Green—System booted and ready
Blinking Green—Degraded system, may be due to the following:
•
•
•
•
The number of operational fans should be more than the minimum number required to cool the system•
Solid Amber—Fatal alarm, the system has failed or shutdown possibly due to one of the following conditions:
•
•
•
•
•
•
•
Blinking Amber—Non-fatal alarm but system is likely to fail possibly due to one of the following conditions:
•
•
Off—POST is running or system is off
Hard Drive LED
Random blinking—indicates disk activity
Off—No disk activity
Back Panel Features
Figure 1-5 depicts the back panel of the MARS 110R, 110, 210, GC2R, and GC2 appliances.
Figure 1-5 Back Panel—MARS 110R, 110, 210, GC2R, and GC2
Connector Descriptions
Table 1-5 describes the type and function of the back panel communication ports of the MARS 110R, 110, 210, GC2R, and GC2.
Table 1-5 Communication Connector Descriptions for MARS 110R, 110, 210, GC2R, and GC2
DB-9 Serial
Table 1-6 lists the pin number assignments for the 9-pin D-subminiature serial port connector.
RJ-45 Serial
Table 1-7 lists the pin numbers assignments for the RJ-45 serial port connector.
Modem Line-in
The MARS Appliance has a V.90 modem for sending SMS and pager alerts. Connect the line-in port to the wall jack using the provided standard telephone cable (RJ-11 connectors).
Modem External Telephone
You can connect a POTS telephone to the telephone port with a standard telephone cable
(RJ-11 connectors).VGA Port
Connect a monitor to this standard VGA port, and a keyboard to the keyboard port to view the console logs and to access the command line interface. It cannot be used at the same time as the Front Panel VGA connector.
Keyboard
PS/2 keyboard connector. To access the console logs, or the command line interface connect a keyboard to the keyboard connector and a monitor to the VGA port.
Mouse
PS/2 mouse port. Not supported.
USB Ports (0 and 1)
Not supported.
Ethernet Add-in NIC connectors
Not supported.
Integrated Ethernet NIC connectors
(eth0 and eth1)10/100/1000-megabit-per-second (Mbps) autosensing Ethernet ports (autosensing detects line speed and duplex mode). MARS supports the operation of both Ethernet connectors. Table 1-7 lists LED descriptions. NIC 1 is eth0 and NIC 2 is eth1.
Each Ethernet connector provides all the functions of a network expansion card and supports the 10BASE-T, 100BASE-TX, and 1000BASE-TX Ethernet standards.
The MARS Appliance monitors network traffic destined to the IP address assigned to eth0. The eth0 connector is the port to which the gateway command applies. Therefore, eth0 must be attached to the network from which the reporting devices are accessible. The eth1 connector is typically used as an out-of-band management network, which provides faster graphical user interface (GUI) response to the administrator. To use eth1, you must define static routes to the destination networks for that interface.
Figure 1-6 Pin Numbers for the Serial Port Connector
Table 1-8 Back Panel LED Descriptions
Power supply LEDs
POST Progress LEDs
10
Available in field service documentation
System Identification LED
14
See Table 1-4
System Status LED
15
See Table 1-4.
Integrated NIC LEDs
Left LED
•
•
•
Right LED
•
(if left LED is active)•
•
Hard Drive Layout
Figure 1-7 Hard Drive Slot Numbers—MARS 110R, 110, 210, GC2R, and GC2
Table 1-9 Mapping Hard Drive Slot Number to CLI PD number—110R, 110, 210, GC2R, GC2
MARS 110R, 110
1.5TB RAID 10
Hot-swappable
Front accessible6 X 500GB SATA-IO HDD,
Seagate Barracuda ES 3 TB3.0Gps, 7200 RPM, 16MB Buffer
Slot 0 is p0
Slot 1 is p1
Slot 2 is p2
Slot 3 is p3
Slot 4 is p4
Slot 5 is p5
Slot 0 and Slot 1
Slot 2 and Slot 3
Slot 4 and Slot 5
2.0TB2 RAID 10
Hot-swappable
Front accessible6 X 750GB SATA-IO HDD,
Seagate Barracuda ES 3 TB3.0Gps, 7200 RPM, 16MB Buffer
1 The stated storage capacity is the sum of the rated capacity of all the hard drives and does reflect bytes reserved for the RAID overhead on each drive.
2 Although there is a total of 4.5 TB storage, RAID 10 has a maximum size configuration of 2 TB Redundant, or 4 TB
Redundant Power Supply Descriptions
The MARS 110R, 110, 210, GC2R, and GC2 ship with two hot-swappable 750 watt redundant (1 + 1) ATX power supplies (PS) which have the following integrated management features:
•
•
•
For procedures on hotswapping a power supply, see Chapter 24, "Hot-swapping a Power Supply Unit."
Caution
Figure 1-8 Power Supply Module—MARS 110R, 110, 210, GC2R, and GC2
Over-Temperature Protection (OTP)
The power supply is protected against over-temperature conditions caused by loss of fan cooling or excessive ambient temperature. In an OTP condition the power supply will shutdown. When the power supply temperature drops to the rated safety limit, the power supply restores power automatically, while the 5 V standby remains constantly on. The power supply alerts the system of the OTP condition with the power supply FAIL signal and the Power LED on the control panel.
Over-Current Protection (OCP)
The power supply and power distribution board shutdown and latch off after an over-current condition occurs. This latch is cleared by an AC power interruption.
Over-Voltage Protection (OVP)
The power supply and power distribution board shutdown and latch off after an over-voltage condition occurs. This latch is cleared by an AC power interruption.
AC Power Source Requirements
Each power supply has a socket to accommodate an AC power cord. Each power supply operates within the parameters listed in Table 1-10.
Table 1-10 AC Power Source Requirements
90 Vrms
180 Vrms
100-127 Vrms
200-240 Vrms
140 Vrms
264 Vrms
85 VAC +/- 4 VAC
75 VAC
12.0 Arms
6.0 Arms
11.0 Arms
5.5 Arms
Minimum: 47 Hz; Rated: 50/60 Hz; Maximum: 63 Hz
1 Maximum input current at low input voltage range is measured at maximum load—minimums are 90VAC for a 110 Line, and 180VAC for a 220 Line.
2 Maximum rated input current is measured at 100VAC and 200VAC.
Power Supply LED Descriptions
Each power supply module has a two-color Amber/Green LED to indicate power supply status.
•
•
•
•
Checking Power Supply Operational Status
Example 1-1 displays the power supply status information in an excerpt of a show healthinfo CLI command output. The power supply unit should evaluated for hotswapping if the status is down. An email alert is sent to the administrator when a power supply changes status from "ok." PS1 is the lower power supply, PS2 is the upper power supply. In normal operation, PS1 supplies most of the power requirements, and PS2 is the redundant power supply.
Example 1-1 Power Supply Status in the show healthinfo CLI Command.
[pnadmin]$ show healthinfo<SNIP>Power Supply Value Status----------------------------------------PS1 AC Current 2.36 Amps okPS2 AC Current 0.12 Amps okPS1 +12V Current 21 Amps okPS2 +12V Current 0 Amps okPS1 +12V Power 248 Watts okPS2 +12V Power 0 Watts okPS1 Status 0x01 okPS2 Status 0x09 ok<SNIP>
1 Sessionize refers to correlating the reported network data. logs, and events into a higher-level interpretation to identify those packets as part of a single session, or a communication, that has a beginning, a body, and an end.
