CS-MARS 4.2.1 support for NM-CIDS

Unanswered Question
Mar 22nd, 2007
User Badges:

I'm currently trying to setup a CS-MARS 4.2.1 to monitor my network devices. I have seen in the configuration guide that it supports cisco swithces and ASA IPS modules, what about a router IPS module? (NM-CIDS)

I'am already added the IPS module to MARS as a standalone IPS 5.x device, tested connectivity and MARS is receiving events from the IPS.

The problem is that all those events are shown as "unkown device" on the reporting device column.

Could this behaviour be related with NM-CIDS not being supported by MARS? Any other idea?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
pmccubbin Thu, 03/22/2007 - 11:53
User Badges:
  • Silver, 250 points or more

It appears that the NM-CIDS is supported.

This was in the documentation on CCO:

http://www.cisco.com/en/US/partner/products/ps6241/products_configuration_example09186a008067a2b0.shtml#wp15514


If the link doesn't work do a search on

Configuring Distributed Threat Mitigation in Cisco Security MARS.


Hardware and Software Requirements



Static IPS Devices


Cisco IPS 4200 Series appliances using Cisco IPS Sensor Software v5.1.1 or greater


Cisco ASA 5500 Series appliances with the Advanced Inspection and Protection module using Cisco ASA Software v5.0 or greater


Cisco IDSM-2 sensor blades for the Cisco Catalyst 6500 Series using Cisco IPS Sensor Software v5.1.1 or greater


Cisco NM-CIDS Network Module (with Cisco IPS Sensor Software v5.1.1 or greater) for Cisco 2600XM, 2800, 3700, and 3800 series routers


Hope this helps.

Actions

This Discussion