mhellman Wed, 05/23/2007 - 06:39
User Badges:
  • Blue, 1500 points or more

look into vacl's and aggregators.

cschweigert Fri, 05/25/2007 - 07:45
User Badges:

Right.... I guess I should back up and provide more information about what I am trying to do. So, I have a 4215 without the 4FE optional 4 port NIC that I want to monitor off of two 3750 routing switches. Would you recommend purchasing the card or spanning all Vlans?

hoogen_82 Sat, 05/26/2007 - 01:40
User Badges:
  • Silver, 250 points or more

In 4215 you would have two interfaces, so that would mean you could have one inline pair. I am sure your two core switch traffic has to route through a fw before reaching the internet.

Need not do a promiscous monitoring, create a pair and place the IPS in between the active PIX and switch. This way whenever we have a active PIX, IPS inspects the traffic flows through it. Now in case of either device failing the secondary path can be used for the traffic to still continue passing. This way the traffic is not inspected but its going to be a rare occurence that your PIX would fail that easily or IPS has a hardware failure.

I am not sure if you can order the 4FE ports seperately contact your partner or Cisco for this information



Do rate if this post helps :)

mhellman Tue, 05/29/2007 - 05:14
User Badges:
  • Blue, 1500 points or more

I assume your goal is to monitor all traffic on both switches? If you're not going to purchase the card, you're going to have to get all the traffic down into a single port (the 4215 only has one monitoring port). You might be able to do that without additional equipment using RSPAN. There are numerous other ways to get the 2 feeds down to "one" (hub, additional switch with SPAN, port aggregator).

If you get the card, you should be able to use a normal SPAN or VACL on each switch and use a separate physical interface on the sensor.


This Discussion