Filter
Top Products
A-30
Cisco Intrusion Prevention System CLI Sensor Configuration Guide for IPS 7.1
OL-19892-01
Appendix A System Architecture
SwitchApp
SwitchApp
The 4500 series sensors have a built in switch that provides the external monitoring interfaces of the
sensor. The SwitchApp is part of the IPS 4500 series design that enables the InterfaceApp and sensor
initialization scripts to communicate and control the switch. Any application that needs to get or set
information on the switch must communicate with the SwitchApp. Additionally the SwitchApp
implements the following:
• Detects bypass—When the SensorApp is not monitoring, the SwitchApp places the switch in bypass
mode and then back to inspection mode once the SensorApp is up and running normally.
• Collects port statistics—The SwitchApp monitors the switch and collects statistics on the external
interfaces of the switch for reporting by InterfaceApp.
• Handles the external interface configuration—When you update the interface configuration, the
configuration is sent to the InterfaceApp, which updates the interface configuration for SwitchApp,
which then forwards that configuration on to the switch.
CLI
The CLI provides the sensor user interface for all direct node access such as Telnet, SSH, and serial
interface. You configure the sensor applications with the CLI. Direct access to the underlying OS is
allowed through the service role. This section describes the IPS CLI, and contains the following topics:
• User Roles, page A-30
• Service Account, page A-31
User Roles
Caution You should carefully consider whether you want to create a service account. The service account
provides shell access to the system, which makes the system vulnerable. However, you can use the
service account to create a password if the administrator password is lost. Analyze your situation to
decide if you want a service account existing on the system.
There are four user roles:
• Viewer—Can view configuration and events, but cannot modify any configuration data except their
user passwords.
• Operator—Can view everything and can modify the following options:
–
Signature tuning (priority, disable or enable)
–
Virtual sensor definition
–
Managed routers
–
Their user passwords
• Administrator—Can view everything and can modify all options that operators can modify in
addition to the following:
–
Sensor addressing configuration
–
List of hosts allowed to connect as configuration or viewing agents