CS-MARS 4.2.1 support for NM-CIDS

[javiercastro]

I'm currently trying to setup a CS-MARS 4.2.1 to monitor my network devices. I have seen in the configuration guide that it supports cisco swithces and ASA IPS modules, what about a router IPS module? (NM-CIDS)

I'am already added the IPS module to MARS as a standalone IPS 5.x device, tested connectivity and MARS is receiving events from the IPS.

The problem is that all those events are shown as "unkown device" on the reporting device column.

Could this behaviour be related with NM-CIDS not being supported by MARS? Any other idea?

[pmccubbin]

It appears that the NM-CIDS is supported.

This was in the documentation on CCO:

http://www.cisco.com/en/US/partner/products/ps6241/products_configuration_example09186a008067a2b0.shtml#wp15514

If the link doesn't work do a search on

Configuring Distributed Threat Mitigation in Cisco Security MARS.

Hardware and Software Requirements

Static IPS Devices

Cisco IPS 4200 Series appliances using Cisco IPS Sensor Software v5.1.1 or greater

Cisco ASA 5500 Series appliances with the Advanced Inspection and Protection module using Cisco ASA Software v5.0 or greater

Cisco IDSM-2 sensor blades for the Cisco Catalyst 6500 Series using Cisco IPS Sensor Software v5.1.1 or greater

Cisco NM-CIDS Network Module (with Cisco IPS Sensor Software v5.1.1 or greater) for Cisco 2600XM, 2800, 3700, and 3800 series routers

Hope this helps.