Cisco Secure IDS and the PostOffice Protocol
The Director platform and sensors must communicate with each other to relay alarms, configurations, messages, and so on. Cisco Secure IDS services communicate with each other by using the PostOffice protocol (not to be confused with e-mail, SMTP, or other mail delivery protocols). These services are the IDS software daemons that exist on the sensors and Director platform. The following are some of the major daemons:
- postofficed
- sapd
- loggerd
- fileXferd
NOTE
These daemons are explained in Appendix B, "Cisco Secure IDS Architecture."
The following sections examine the aspects of the Cisco Secure IDS communications infrastructure:
- PostOffice protocol
- PostOffice features
- PostOffice identifiers
- PostOffice addressing scheme
PostOffice Protocol
The proprietary PostOffice protocol provides a communication vehicle between your sensors and your Director platform. It uses the UDP transport on port 45000. The following types of messages are sent using the PostOffice protocol:
- Command
- Error
- Command log
- Alarm
- IP log
- Redirect
- Heartbeat
PostOffice Features
- Reliability
- Redundancy
- Fault tolerance
Reliability
When a sensor generates an alarm, it transmits this information to the Director platform. The sensor needs to guarantee that the Director received the alarm information. The PostOffice protocol supports guaranteed delivery by requiring an acknowledgment for every message sent (see Figure 4-8). When the sensor sends a message to the Director, the Director must reply with an acknowledgment within a predetermined length of time. If the acknowledgment is not received, the sensor retransmits the message repeatedly until the acknowledgment is received.
){kind=link}
Figure 4-8 PostOffice Protocol Reliability.
Redundancy
In many network topologies, you want a sensor to transmit alarm messages to multiple Directors. Notifying multiple Directors enables you to inform multiple personnel when sensors detect intrusive activity on your network. The PostOffice protocol enables sensors to propagate messages up to 255 destinations (see Figure 4-9). This feature allows for redundant alarm notifications, which ensures that the appropriate personnel are notified when an alarm is received.
){kind=link}
Figure 4-9 PostOffice Protocol Redundancy.
Fault Tolerance
With the PostOffice protocol, you can have up to 255 alternate IP addresses for a single host (see Figure 4-10). These alternate IP addresses represent different network interface cards (NICs) on your multihomed Director. The alternate routing protocol automatically switches to the next IP address on your Director whenever the current connection fails. It also uses a system watchdog to detect when a connection to the preferred IP address is reestablished, at which time the sensor reverts to the primary address.
){kind=link}
Figure 4-10 PostOffice Protocol Fault Tolerance
By placing multiple NICs into your Director, you make it a multihomed system. It can then receive traffic from multiple networks. By configuring the IP addresses for all the NICs into the PostOffice protocol, your sensors can contact your Director via any of the alternate IP addresses. The sensor uses these backup addresses, however, only if the primary address programmed into the sensor is inaccessible.
Using a multihomed Director increases the fault tolerance of your Cisco Secure IDS by increasing availability to the Director. However, using multiple NICs is not the only key to fault tolerance. To obtain the highest fault tolerance, you also need to ensure that multiple paths exist to the different NICs on your Director. Therefore, a single network failure is unlikely to prevent your sensor from communicating with your Director.
Multihomed Systems
Many machines have a single NIC. These machines can send and receive network traffic only through this one interface and are known as single-homed devices. To route traffic between different networks, routers usually have multiple NICs. (At a minimum, a router must have two NICs.) A router is a good example of a multihomed device. Sometimes, you want a regular system, such as a server, to also be multihomed for network accessibility. By placing multiple NICs on your server, you connect that system to multiple networks. Each of these NICs has a separate IP address for the network to which it is connected. Traffic that needs to reach your server can go to any of the IP addresses for the server. If a router fails on one network, users can still reach your server by using another path and network interface. By multihoming your Director, you gain the same fault tolerance by providing multiple paths between your sensors and your Director.
PostOffice Identifiers
){kind=link}
- Host ID
- Organization ID
- Host name
- Organization name
Figure 4-11 Cisco Secure IDS PostOffice Identifiers.
Host ID
Each device with the same organization ID requires a unique host identifier (host ID). The host ID is a numeric value greater than zero for each Cisco Secure IDS device.
Organization ID
An organization identifier (organization ID) groups each collection of Cisco Secure IDS devices. The organization ID, like the host ID, is a numeric value greater than zero. It can be used to group a number of Cisco Secure IDS devices under the same number for easy identification purposes.
Host Name
Each Cisco Secure IDS device is labeled with an alphanumeric identifier. The name chosen is typically one that contains the word sensor or director, which enables you to easily identify the device type.
Organization Name
Each group of Cisco Secure IDS devices is associated with an alphanumeric identifier. The name chosen is typically one that describes the name of the company where the device is installed or the name of the department within the company where the device is installed.
PostOffice Addressing Scheme
Figure 4-12 illustrates an example in which the sensor (20.100) is transmitting a PostOffice message to the Director platform (10.100). The packetd service on the sensor (application ID 10008) generates the alarm message destined for the smid service (application ID 10006) on the Director platform. When the Director receives the alarm message, the Director platform's postofficed service (application ID 10000) sends an acknowledgment (ACK) message to the postofficed service on the sensor (application ID 10000).
){kind=link}
Figure 4-12 PostOffice Addressing Parameters.