Re: sort of a newbie question

jones10 · ‎01-27-2003

I know that I have seen it somewhere, but I can't seem to locate that information now that I am looking for it: On the CSPM2.3.3i, what default encryption scheme is used in between the client and the CSPM server on TCP 2567. Is the communication between the sensor and the server on UDP 45000 encrypted by default? Is there a signature version upgrade addressing the recent SQL exploits for the IDSM?

marcabal · ‎01-28-2003

"I know that I have seen it somewhere, but I can't seem to locate that information now that I am looking for it: On the CSPM2.3.3i, what default encryption scheme is used in between the client and the CSPM server on TCP 2567. "

I don't know the answer to this one.

"Is the communication between the sensor and the server on UDP 45000 encrypted by default?"

No IPSEC has to be manually enabled on both the sensor and CSPM machine.

"Is there a signature version upgrade addressing the recent SQL exploits for the IDSM?"

Not available yet. The Appliance update was done using signature engines similar to creating a custom signature so did not require a binary change. The IDSM does not use signature engines so a new binary is having to be compiled and tested. The IDSM update will be sent out as soon as possible.

jones10 · ‎02-06-2003

When installing the CSPM2.3.3i within a client-server mode. What purpose does the Cisco Secure VPN Client serve, and is it necessary to install in order for the CSPM to work properly?

jones10 · ‎02-08-2003

OK. Does the Policy Reporter reports (on-demand or not) available through TCP 443 ssl depend on whether or not the Cisco Secure VPN Client is installed? OR is 8080 and 443 enabled by default and accessible though the CSPM client irregardless of whether the VPN client is installed.

If I were to put the CSPM233i into its main components, what would the main components be (i.e. policy monitor, policy reporter,...)?

marcabal · ‎02-11-2003

In an IDS deployment I believe the VPN Client is only used when IPSEC is configured between the sensor and the CSPM machine.

But my CSPM experience is limited so I can't guarantee that it is the only time it is accessed.