This topic covers the following information:
IPS policy configuration and application
Aggregation of IPS data
Limitations for managing IPS‑enabled platforms
IPS policy configuration and application
You can use a Central Management System appliance to configure and apply IPS policies at managed IPS-enabled platforms.
IPS Policy Configuration
From a Central Management System appliance CLI, you can create, modify, or delete custom IPS policies on a managed IPS-enabled platform. For more information, see Configuring an IPS policy using a CMC profile (CLI).
IPS Policy Application at Monitoring Interfaces
From a Central Management System appliance Web UI or CLI, you can apply IPS policies to monitoring interfaces on managed IPS-enabled platforms. The IPS policy definitions must be identical on the managed platforms. For more information, see Applying an IPS policy to managed platforms (Web UI) or Applying an IPS policy to managed platforms (CLI).
For general information about Network Security appliances managed from a Central Management System appliance, see the Network Security System Administration Guide.
Aggregation of IPS data
You can use a Central Management System appliance to aggregate IPS data consolidated across the centrally managed IPS-enabled platforms. You can display IPS events, display IPS alerts (MVX-correlated IPS events), and generate IPS reports.
IPS Events
On a Central Management System appliance that manages one or more IPS-enabled platforms, you can filter the IPS Events page to display IPS events and IPS alerts for a single IPS-enabled platform or for multiple platforms. If the Central Management System appliance manages multiple IPS-enabled platforms, the page displays consolidated results.
IPS Alerts
On a Central Management System appliance that manages one or more IPS-enabled platforms, you can filter the Alerts tab to display the IPS alerts for a single Network Security appliance or for a group of Network Security appliances. If the Central Management System appliance manages multiple IPS-enabled platforms, the page displays consolidated results that include all IPS alerts generated on the managed appliances.
IPS Event Acknowledgment
On a Central Management System appliance that manages one or more IPS-enabled platforms, you can acknowledge IPS events detected at one of the managed appliances. The updated acknowledgment information is aggregated at the Central Management System appliance, but is not pushed to the managed appliance.
IPS Reports
On a Central Management System appliance that manages one or more IPS-enabled platforms, you can use the Reports page to generate the following IPS-specific reports:
IPS Executive Summary
IPS Top N Attacks
IPS Top N Attackers
IPS Top N Victims
IPS Top N MVX-Correlated
Limitations for managing IPS‑enabled platforms
When using a Central Management System appliance to manage an IPS-enabled platform, be aware of the following limitations:
IPS Policy Configuration Reports
The Central Management System appliance Reports page does not support the following IPS reports:
IPS Policy Configuration Summary
IPS Policy Configuration Details
IPS Dashboard Data
The Central Management System appliance Dashboard displays malware information only and does not include the IPS Dashboard panels that are available on locally managed IPS-enabled platforms.
Custom IPS Rules
The Central Management System appliance IPS Custom Rules page does not support importing of custom IPS rules to a managed IPS-enabled platform.