The Cisco® IDS Network Module is part of the Cisco integrated intrusion detection system (IDS) network security solutions that enable organizations to protect assets and reduce operating costs.

Figure 1. Cisco IDS Network Module Sensors Deployment on Cisco 2600, 2800, 3600, 3700, or 3800

FLEXIBLE DEPLOYMENT OPTIONS IN CISCO ROUTERS:

Figure 2.

CISCO IDS NETWORK MODULE FOR THE CISCO 2600, 2800, 3600, 3700, AND 3800 SERIES ROUTERS: INTEGRATING IDS AND BRANCH OFFICE ROUTING

• Physical Space Savings-The Cisco IDS Network Module uses a single network module slot in a Cisco Series branch office router.

• Investment Protection-Designed to take advantage of the Integrated Services Routers 2811, 21,51 and 3800 Routers Enhanced Network Modules (NMEs) slot.

• Simple Power and Cable Management-The IDS network module takes advantage of the power options of the router, including DC power and redundant power.

• Common Management Interface-The IDS network module can be configured and managed from the Cisco IOS® command-line interface (CLI). This network module supports all the same CiscoWorks Management Center for IDS Sensors that the Cisco IPS 4200 Series supports, allowing customers to use one centralized management system for both appliance and router sensors.

• Network Command and Control Interface-By using the external Fast Ethernet port for command and control, the Cisco IDS Network Module internal router connection is free to capture the packets to the network module for processing by the IDS engine.

• Separate Processor for the Cisco IDS Network Module to Maximize Performance-Having a dedicated CPU in the network module frees the router CPU from process-intensive IDS tasks.

• Lower Operational Costs-The Cisco IDS network module is covered via Cisco maintenance service for the router. This setup minimizes network operational costs.

• Storage-The NM-CIDS ship with a 40-gigabyte hard disk that is used for logging (security forensic ) and storage of signatures

• Performance-the Cisco IDS Network Module can monitor up to 45 Mbps of traffic and is suitable for T1/E1 and T3 environments.

• Security In Depth-A router installed with this IDS network module also supports other Cisco IOS security features such as VPN, firewall, Multiprotocol Label Switching (MPLS), Network Address Translation (NAT), and Web Cache Control Protocol (WCCP), while supporting all common Cisco IOS functions.

• Dedicated Command and Control-The external Ethernet port is used for command and control to enable a secure outbound port for management. This setup also allows for both security operations and network operations to have their own command and control interfaces.

Figure 3. Cisco IDS Network Module

CISCO INTRUSION PROTECTION SYSTEM ADVANTAGES

Accurate Prevention Technologies

• Risk Rating-Offers unprecedented reliability and complete confidence to enable your inline prevention deployment. Traditional intrusion prevention has relied on severity rating as its sole method of determining the potential damage associated with an event; Cisco Risk Rating provides a more accurate representation and risk-balanced assessment of the potential damage per event through the use of four separate values:

–Event severity-A user-modifiable weighted value indicating potential damage per event

–Signature fidelity- A user-modifiable weighted value indicating accuracy of the signature

–Asset value-A user-defined value indicating the importance of the attack target

–Attack relevancy-An internal weighted value based on the susceptibility of the target to this attack type

• Meta-Event Generator (MEG)-Provides unique correlation of events in order to accurately detect and stop worms. As worms move through your network, they generate many alarms of varying degrees of severity. Cisco MEG links these seemingly unrelated lower-severity alarms into a high-severity, high-risk event, enabling the user to confidently drop the associated packets. MEG achieves this by modeling worm behavior, correlating specific time between events, network behavior, and multiple exploit behavior.

Flexible Deployment Options

Easy Installation

Hardware Architecture

Figure 4. Architecture of the Integrated Cisco IDS Network Module with the CiscoWorks VPN/Security Management Solution 2.1

Primary Management Features

• CiscoWorks Management Center for IDS Sensors-Used for configuring network and switch IDS sensors and provides a scalable foundation to configure multiple sensors concurrently using group profiles

• CiscoWorks Monitoring Center for Security-Integrated monitoring used to capture, store, view, correlate, and report on events from network IDS, switch IDS, host IDS, firewalls, and routers

• Cisco CS-MARS-offers a family of high-performance, scalable appliances for threat management, monitoring, and mitigation. Cisco CS-MARS combines network intelligence, context correlation, vector analysis, anomaly detection, hotspot identification, and automated mitigation capabilities

CISCO IDS NETWORK MODULE PRODUCT SUMMARY

Network Modules

Table 1. Cisco IDS Network Module Product Number

Required Software Licenses

Table 2.

Supported Routers

Table 3. Platforms that support the Cisco IDS Network Module

HARDWARE SPECIFICATIONS

Table 4. Hardware specifications of Cisco IDS Network Module

PRODUCT SPECIFICATIONS CHARACTERISTICS

Table 5. Specifications of Cisco IDS Network Module

Note:

• Five hundred new TCP connections per second

• Five hundred HTTP transactions per second

• Average packet size of 445 bytes

• Running Cisco IDS 5.0 Sensor Software