Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Events from Imperva FW (SS-WAF-G2G)

Hi,

Does anybody know what are the capabilities of MARS to support Imperva FireWalls? Maybe someone has this type of FW in their MARS environment? I am concerning about pulling as much info as possible to CS-MARS from this device. I would appreciate if some would share their experience with me.

Regards,

GP

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Events from Imperva FW (SS-WAF-G2G)

GP;

  CS-MARS does not natively support the Imperva firewall.  This means out-of-the-box, CS-MARS cannot parse any messages received by this device.  You could create your own custom device using the CS-MARS Device Support Framework (DSF).  This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event.  This process is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/cfgCustm.html

  There is also a custom device package sharing forum here in the community:

https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions

  I do not currently see any discussion in that forum regarding the Imperva firewall.

Scott

1 REPLY
Cisco Employee

Re: Events from Imperva FW (SS-WAF-G2G)

GP;

  CS-MARS does not natively support the Imperva firewall.  This means out-of-the-box, CS-MARS cannot parse any messages received by this device.  You could create your own custom device using the CS-MARS Device Support Framework (DSF).  This requires creating custom parsers for the various messages you wish to have CS-MARS parse and map to a CS-MARS event.  This process is outlined here:

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/user/guide/combo/cfgCustm.html

  There is also a custom device package sharing forum here in the community:

https://supportforums.cisco.com/community/netpro/security/mars-pkg?view=discussions

  I do not currently see any discussion in that forum regarding the Imperva firewall.

Scott

393
Views
0
Helpful
1
Replies