ccna 5.2.1.4

ccna 5.2.1.4.Configure the sensor so that it periodically checks the SFTP server against new feature packets. Stagger each sensor throughout the day to check the SFTP server against new feature packets, or you can check the SFTP server through a scheduled change window. This prevents multiple sensors from requesting the same file at the same time and overwhelming the SFTP server.Keep the feature levels supported on the management console synchronized with the feature packets on the sensor. Note: You can then continue to configure the ISR G2 router so that it automatically downloads updated IPS feature definition files. This is an alternative to relying on an SFTP server for updates.5.2.6 IPS Global Associations5.2.6.1 Cisco Global AssociationsIn addition to maintaining feature packages, the Cisco IPS includes a security feature called Cisco Global Correlation. Through global correlation, Cisco IPS devices receive periodic updates from a central Cisco threat database called CiscoSensorBaseNetwork. The CiscoSensorBase Network contains real-time, detailed information about known threats to the Internet _h.Participating IPS devices are part of the SensorBase Network and receive global association updates that contain information about network devices and the reputation of malicious activity (REPUTATION). Similar to human socialization, a reputation is an opinion associated with a device on the Internet±. Network devices with reputation are most likely to be malicious or virus-infected devices. Reputation analysis data included in global correlation updates needs to be considered in network traffic analysis. This increases the effectiveness of the IPS because traffic is denied or allowed based on the reputation of the source IP address.Note: Cisco global correlation is available for Cisco IPS4300 and 4500 series devices, as well as the CiscoASA5500-X and ISRG2 IPS modules.5.2.6.2 Cisco SensorBase NetworkIPS sensors can be configured to participate in global association updates and/or send telemetry data (telemetrydata). Both of these services can also be disabled.When participating in a global association, Cisco SensorBase Network provides the IPS sensor with information about the IP address with the reputation. This information can be used to determine what action should be taken when the sensor receives potentially harmful traffic from a host with a known reputation. Because the global association database changes quickly, the sensor must periodically download global association updates from the global association server. It is possible to view the reputation score of an event as well as the reputation score of the attacker. Statistics can also be viewed through reputation filters.