Farrukh Haroon Tue, 08/19/2008 - 23:38
User Badges:
  • Red, 2250 points or more

You can see this both from the Cataylyst Switch configuration and the IDS itself.

In the 6500 switch if its inline VLAN pair you will form a trunk to the IDSM like this:

intrusion-detection port-channel 5 trunk allowed-vlan 130,140

If it is Inline Phyiscal interfae you will see something like:

intrusion-detection module 4 data-port 1 access-vlan

In case of promiscious you will have SPAN/capture configuration.

On the IDS cli you can see it via CLI:

physical-interfaces GigabitEthernet0/8

subinterface-type inline-vlan-pair

subinterface 7

vlan1 160

vlan2 760

This is an example of Inline VLAN Pair.



aksher@cisco Wed, 08/20/2008 - 13:10
User Badges:

I can see

inline-interfaces test

no description

interface1 GigabitEthernet0/7

interface2 GigabitEthernet0/8

on CLI of IDSM which means it's in inline VLAN pair but however i can also see SPAN through monitor commands which means it's in promiscous mode. Which is correct?

Farrukh Haroon Wed, 08/20/2008 - 18:36
User Badges:
  • Red, 2250 points or more

No you IDS seems to be in 'Inline Interface Pair' mode and not Inline VLAN pair mode and definitely not in promiscuous mode. Those span settings must be for something else on the switch.

In IDM >> Virtual Sensor Configurationyou sill see it spelled out pretty clearly.

If possible post 'show run | inc intrusion' from your core switch.



aksher@cisco Thu, 08/21/2008 - 15:23
User Badges:

Thanks Farrukh! I am sending the output here,

sh run | i intrusion

intrusion-detection module 2 management-port access-vlan 333

intrusion-detection module 2 data-port 1 autostate include

intrusion-detection module 2 data-port 1 portfast enable

monitor session 2 destination intrusion-detection-module 2 data-port 1

Also it would be great if you explain the over all stuff in quick reference style:)

Farrukh Haroon Thu, 08/21/2008 - 19:14
User Badges:
  • Red, 2250 points or more

The intrusion detection module is connected to the switch back plane via a 'hidden' link. Which can be seen by show ether channel tough. The IDSM in total has 8 ports. In your configuration the management/command&control port belongs to VLAN 333 (this is port gig 0/1 on the IDSM I think). This port is represented by 'management-port' in the IDSM config.

Ports gig x/7 and gig x/8 are the two 'sensing' ports. These are represented by 'data-port' 1 and 2 in the IDSM config. In you case all data from some interface(s)/vlan(s) is being sent to the 'first' sensing port of the IDSM. So in short you are using promiscuous mode. For more details on what traffic is being sent, have a look at the 'show monitor session' command.

Please rate if helpful.




This Discussion