Home > Articles > Cisco Network Technology > General Networking > Intrusion Detection: Cisco IDS Overview

Intrusion Detection: Cisco IDS Overview

Chapter Description

Cisco Secure IDS is a network-based intrusion detection system that uses a signature database to trigger intrusion alarms. The major components are a sensor platform and a director platform. The sensor platform monitors the network and the director platform provides a single GUI management interface for the end user. This chapter describes the available plaforms and explains how they interact.

This sample chapter is excerpted from Cisco Secure Intrusion Detection Systems.

Cisco Secure IDS and the PostOffice Protocol

The Director platform and sensors must communicate with each other to relay alarms, configurations, messages, and so on. Cisco Secure IDS services communicate with each other by using the PostOffice protocol (not to be confused with e-mail, SMTP, or other mail delivery protocols). These services are the IDS software daemons that exist on the sensors and Director platform. The following are some of the major daemons:

  • postofficed
  • sapd
  • loggerd
  • fileXferd

NOTE

These daemons are explained in Appendix B, "Cisco Secure IDS Architecture."

The following sections examine the aspects of the Cisco Secure IDS communications infrastructure:

  • PostOffice protocol
  • PostOffice features
  • PostOffice identifiers
  • PostOffice addressing scheme

PostOffice Protocol

The proprietary PostOffice protocol provides a communication vehicle between your sensors and your Director platform. It uses the UDP transport on port 45000. The following types of messages are sent using the PostOffice protocol:

  • Command
  • Error
  • Command log
  • Alarm
  • IP log
  • Redirect
  • Heartbeat

PostOffice Features

The PostOffice protocol provides a critical communication link between your Director platform and your IDS sensors. Being the primary method of communication, the PostOffice protocol must support certain necessary functionality:
  • Reliability
  • Redundancy
  • Fault tolerance

Reliability

When a sensor generates an alarm, it transmits this information to the Director platform. The sensor needs to guarantee that the Director received the alarm information. The PostOffice protocol supports guaranteed delivery by requiring an acknowledgment for every message sent (see Figure 4-8). When the sensor sends a message to the Director, the Director must reply with an acknowledgment within a predetermined length of time. If the acknowledgment is not received, the sensor retransmits the message repeatedly until the acknowledgment is received.

Figure 4-8 PostOffice Protocol Reliability.

Redundancy

In many network topologies, you want a sensor to transmit alarm messages to multiple Directors. Notifying multiple Directors enables you to inform multiple personnel when sensors detect intrusive activity on your network. The PostOffice protocol enables sensors to propagate messages up to 255 destinations (see Figure 4-9). This feature allows for redundant alarm notifications, which ensures that the appropriate personnel are notified when an alarm is received.

Figure 4-9 PostOffice Protocol Redundancy.

Fault Tolerance

With the PostOffice protocol, you can have up to 255 alternate IP addresses for a single host (see Figure 4-10). These alternate IP addresses represent different network interface cards (NICs) on your multihomed Director. The alternate routing protocol automatically switches to the next IP address on your Director whenever the current connection fails. It also uses a system watchdog to detect when a connection to the preferred IP address is reestablished, at which time the sensor reverts to the primary address.

Figure 4-10 PostOffice Protocol Fault Tolerance

By placing multiple NICs into your Director, you make it a multihomed system. It can then receive traffic from multiple networks. By configuring the IP addresses for all the NICs into the PostOffice protocol, your sensors can contact your Director via any of the alternate IP addresses. The sensor uses these backup addresses, however, only if the primary address programmed into the sensor is inaccessible.

Using a multihomed Director increases the fault tolerance of your Cisco Secure IDS by increasing availability to the Director. However, using multiple NICs is not the only key to fault tolerance. To obtain the highest fault tolerance, you also need to ensure that multiple paths exist to the different NICs on your Director. Therefore, a single network failure is unlikely to prevent your sensor from communicating with your Director.

Multihomed Systems

Many machines have a single NIC. These machines can send and receive network traffic only through this one interface and are known as single-homed devices. To route traffic between different networks, routers usually have multiple NICs. (At a minimum, a router must have two NICs.) A router is a good example of a multihomed device. Sometimes, you want a regular system, such as a server, to also be multihomed for network accessibility. By placing multiple NICs on your server, you connect that system to multiple networks. Each of these NICs has a separate IP address for the network to which it is connected. Traffic that needs to reach your server can go to any of the IP addresses for the server. If a router fails on one network, users can still reach your server by using another path and network interface. By multihoming your Director, you gain the same fault tolerance by providing multiple paths between your sensors and your Director.

PostOffice Identifiers

You must assign each Cisco Secure IDS device a unique numeric identifier. This unique numeric identifier is a combination of host identification components and organization identification components. Associated with the host identifier is an alphanumeric host name. Similarly, associated with the organization identifier is an alphanumeric organization name. The following are the individual PostOffice identifiers. (See Figure 4-11 for an illustration of the main parameters used by the PostOffice protocol to identify Cisco Secure IDS components.)
  • Host ID
  • Organization ID
  • Host name
  • Organization name

Figure 4-11 Cisco Secure IDS PostOffice Identifiers.

Host ID

Each device with the same organization ID requires a unique host identifier (host ID). The host ID is a numeric value greater than zero for each Cisco Secure IDS device.

Organization ID

An organization identifier (organization ID) groups each collection of Cisco Secure IDS devices. The organization ID, like the host ID, is a numeric value greater than zero. It can be used to group a number of Cisco Secure IDS devices under the same number for easy identification purposes.

Host Name

Each Cisco Secure IDS device is labeled with an alphanumeric identifier. The name chosen is typically one that contains the word sensor or director, which enables you to easily identify the device type.

Organization Name

Each group of Cisco Secure IDS devices is associated with an alphanumeric identifier. The name chosen is typically one that describes the name of the company where the device is installed or the name of the department within the company where the device is installed.

PostOffice Addressing Scheme

Now that you understand the PostOffice identifiers, it is time to explain how these identifiers are used in the Cisco Secure IDS addressing scheme. This addressing scheme is composed of three components. The host and organization identifiers represent the first two components of the PostOffice proprietary addressing scheme. The third component of the addressing scheme is a unique application identifier. The PostOffice protocol uses all three of these unique identifiers to route command and control communications.

Figure 4-12 illustrates an example in which the sensor (20.100) is transmitting a PostOffice message to the Director platform (10.100). The packetd service on the sensor (application ID 10008) generates the alarm message destined for the smid service (application ID 10006) on the Director platform. When the Director receives the alarm message, the Director platform's postofficed service (application ID 10000) sends an acknowledgment (ACK) message to the postofficed service on the sensor (application ID 10000).

Figure 4-12 PostOffice Addressing Parameters.