Table of Contents

Introduction

This guide describes how to use the Management Center for IDS Sensors (IDS MC) to manage configurations for Cisco Intrusion Detection System Sensors.

Cisco Intrusion Detection System Sensors are network devices that perform real-time monitoring of network traffic for suspicious activities and active network attacks. Sensors come in two physical models: dedicated, standalone network appliances and line-card modules running in certain Cisco Catalyst 6000 switches. The sensor analyzes network packets to determine if their contents appear to indicate an attack against your network.

IDS MC manages configurations for up to 300 Cisco Intrusion Detection System Sensors. You use a series of web-based screens to manage all aspects of sensor configuration. You can manage individual sensors, and you can manage groups of sensors having a common configuration. The sensor configuration data resides in a database.

A separate but closely related product, Monitoring Center for Security (Security Monitor), provides event collection, viewing, and reporting capability for network devices. You can install IDS MC by itself or with Security Monitor. (You can also install Security Monitor by itself.) You must install CiscoWorks before installing IDS MC or Security Monitor. Figure 1-1 outlines the functions of these products and shows the database where the sensor configuration data resides.

Caution   Do not attempt to install IDS MC on a host on which Cisco Secure Policy Manager (CSPM) has been installed because the installer for Security Monitor attempts to install the Cisco Intrusion Detection System postoffice in a second location on that host.

IDS MC runs on Windows 2000 platforms. Use the CiscoWorks interface to log in to IDS MC. After logging in through CiscoWorks, you can view the IDS MC interface.