Chapter Review

Chapter Review

Extensive planning and preparation are required before deploying sensors on your Internetwork. Until some auditing and planning are done, you can’t even be sure which sensors are needed. This chapter discussed the planning and auditing that can be accomplished to determine where sensors should be deployed throughout the internetwork.

This chapter reviewed the common deployment strategies that have worked in previous IDS deployments and the factors that assist with the deployment strategy, such as

• Network entry points

• Network size and complexity

• The amount and type of traffic to be monitored

This chapter described in detail the methods that can be used to configure the sensors once they’ve been deployed. The built-in script sysconfig-sensor can be used to configure the sensor for network connectivity. In addition, this application is used to enable the IDS Device Manager.

Once the sensors are bootstrapped, the IDS Device Manager can be used to configure the operations of each sensor, fine-tuning the IDS system. The IDS Device Manager presents the configuration in a common and intuitive web interface to ease the configuration burden. The configuration and management of the sensor through the Device Manager is broken into four configuration and management areas, which are as follows:

• Device

• Configuration

• Monitoring

• Administration

Each area is then broken down into Sub-Areas, which contain Table of Content (TOC) items. Each TOC item has a configuration or report pane that’s used to configure the sensor or to display the report.