Solved: IPS in datacenter

asim.mz99 · ‎07-19-2008

IPS 4270 connected to distribution in datacenter, each with each 6509, now the question is how will redundancy/failover works both in inline and out of band usage.

Farrukh Haroon · ‎07-31-2008

Yes, and most importantly any configuration change you need to make (like signature tuning) need to be done to each individual sensor unless you have CSM. This is pretty annoying, from your signature it seems you work for a gold partner, pass the message across to Cisco, to stop the lame marketing stuff 'we don't need regular failover STP/ECLB are enough' and ask them to provide a proper failover solution.

Regards :)

Farrukh

View solution in original post

rhermes · ‎07-30-2008

The appliance sensors do not have the ability to synchronize state between two sensors like a firewall can. This means that any High Availability (HA) araingment with dual sensors in line will not fail over gracefully. Depending on what signatures you have set to drop, some sessions will be terminated when you fail over in an in-line mode. If you put your sensor pair in promiscious mode, there will be no ill effect on traffic. The worst that could happen is you might miss a number of events or trigger false positives as the TCP sessions in progress move to the alternate sensor.

asim.mz99 · ‎07-30-2008

As you say that it will not failover gracefully but it can go for failover in non gracefull way, how would be that ?

Farrukh Haroon · ‎07-30-2008

Have a look at this:

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc11c11

http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&topicID=.ee6e1fc&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc106a7

Check out the pdf in the second link.

Regards

Farrukh

asim.mz99 · ‎07-30-2008

Thanks Farrukh,

Just see the PPT, but have some more questions,

1) In Layer 2 design will IPS be the default gateway.

2) If yes then technically fwsm and ACE should be in bridge mode. Also what would be the traffic flow.

3, Also in Layer 3 design if one IPS fail in a switch how the other in the other switch will continue the traffic.

Asim

Farrukh Haroon · ‎07-30-2008

1) No the Cisco IPS don't support any Layer 3 mode. The IPS is at layer 2, Spanning Tree is used to failover in case one of the boxes go down.

2) See Above

3) It uses Etherchannel (ECLB). Have a look at:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/eclbips5.htm

Please rate if helpful.

Regards

Farrukh

asim.mz99 · ‎07-31-2008

That really helps, just have last following concern, please correct me if i am wrong.

From your inputs and details it looks like if we have two 6500 in datacenter connected with two separate IPS with the same configurations.They don't have any link between them and cannot provide statefull failover, but at least work as backup for each other.

Farrukh Haroon · ‎07-31-2008

Yes, and most importantly any configuration change you need to make (like signature tuning) need to be done to each individual sensor unless you have CSM. This is pretty annoying, from your signature it seems you work for a gold partner, pass the message across to Cisco, to stop the lame marketing stuff 'we don't need regular failover STP/ECLB are enough' and ask them to provide a proper failover solution.

Regards :)

Farrukh