Filter
Top Products
A-28
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix A System Architecture
CollaborationApp
CollaborationApp
This section describes the CollaborationApp, and contains the following sections:
• Understanding the CollaborationApp, page A-28
• Update Components, page A-28
• Error Events, page A-29
Understanding the CollaborationApp
The CollaborationApp is a peer of the MainApp and the SensorApp. It interfaces with them using various
interprocess communication technologies, such as IDAPI control transactions, semaphores, shared
memory, and file exchange.
Reputation updates are exchanged between the Global Correlation server and the CollaborationApp. The
CollaborationApp communicates with the sensors using four update components:
• Set of rules score weight values
• Set of IP addresses and address ranges, which together with the rules and alerts provide the
information needed to calculate reputation scores
• List of IP addresses and address ranges for which traffic should always be denied
• Network participation configuration, which allows the server to control the rate at which sensors
send telemetry date to the server
The sensor sends collaboration information to the Network Participation server. The sensor queries the
Global Correlation server for a list of what collaboration updates are available and from which Global
Correlation server to download the update files.
Note The SensorApp starts before the CollaborationApp, but they initialize asynchronously. Therefore, it is
possible that the Reputation Update server may download and attempt to apply one or more global
correlation updates before the SensorApp is ready to accept the update. The update server may download
and partially process the update, but it must wait until the SensorApp is ready before it can commit the
update.
For More Information
For detailed information on global correlation and how to configure it, see Chapter 10, “Configuring
Global Correlation.”
Update Components
The Global Correlation Update client exchanges manifests with the Global Correlation Update server. It
parses the server manifest to determine what new updates are available for download and where they
reside, and then builds a list of updates to be installed. If all updates are applied successfully, then the
Global Correlation Update client commits the applied updates for each component, notifies SensorApp
that new updates are available, and updates the client manifest to reflect the latest committed updates for
each component.