Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Cisco NGIPS

To integrate JSA Risk Manager with your network devices, ensure that you review the requirements for the Cisco Next-Generation Intrusion Prevention System (NGIPS) adapter.

The following features are available with the Cisco NGIPS adapter:

  • IPS

  • SSH connection protocol

Limitations:

  • Intrusion policies attached to individual access control rules are not used by JSA Risk Manager. Only the default intrusion policy is supported.

  • NAT and VPN are not supported.

The following table describes the integration requirements for the Cisco NGIPS adapter.

Table 1: Integration Requirements for the Cisco NGIPS Adapter

Integration requirement

Description

Versions

6.2.0

SNMP discovery

No

Required credential parameters

To add credentials in JSA log in as an administrator and use Configuration Source Management on the Admin tab.

Username

Password

Supported connection protocols

To add protocols in JSA, log in as an administrator and use Configuration Source Management on the Admin tab.

SSH

Commands that the adapter requires to log in and collect data

show version

show memory

show network

show interfaces

expert

sudo

su

df

hostname

ip addr

route

cat

find

head

mysql

Commands that the adapter uses to read configuration information:

To get hardware information.

To get the system host name.

To get routing information.

Use the cat or head command to read files and get configurations.

Read to get the base directory for the SNORT instance, which is referenced as $DE_DIR in the following three examples:

Read the IPS rules and objects.

Read the SNORT configuration.

Files are read in dynamically when they are referenced in the policyText_full.yaml file.

The adapter uses the find command is to search for IP reputation files in this directory.

File that is read to get the database connection credentials.

sudo su df

sudo su hostname

sudo su route -n

/etc/sf/ims.conf

$SNORT_DIR/fwcfg/affinity.conf

$DE_DIR/policyText_full.yaml

$DE_DIR/snort.conf

$DE_DIR/*

$SNORT_DIR/iprep_download

/etc/sf/ims-data.conf

Related Documentation