IDSM

Unanswered Question
Farrukh Haroon Tue, 08/19/2008 - 23:38

You can see this both from the Cataylyst Switch configuration and the IDS itself.

In the 6500 switch if its inline VLAN pair you will form a trunk to the IDSM like this:

intrusion-detection port-channel 5 trunk allowed-vlan 130,140

If it is Inline Phyiscal interfae you will see something like:

intrusion-detection module 4 data-port 1 access-vlan

In case of promiscious you will have SPAN/capture configuration.

On the IDS cli you can see it via CLI:

physical-interfaces GigabitEthernet0/8

subinterface-type inline-vlan-pair

subinterface 7

vlan1 160

vlan2 760

This is an example of Inline VLAN Pair.

Regards

Farrukh

Farrukh Haroon Wed, 08/20/2008 - 18:36

No you IDS seems to be in 'Inline Interface Pair' mode and not Inline VLAN pair mode and definitely not in promiscuous mode. Those span settings must be for something else on the switch.

In IDM >> Virtual Sensor Configurationyou sill see it spelled out pretty clearly.

If possible post 'show run | inc intrusion' from your core switch.

Regards

Farrukh

Thanks Farrukh! I am sending the output here,

sh run | i intrusion

intrusion-detection module 2 management-port access-vlan 333

intrusion-detection module 2 data-port 1 autostate include

intrusion-detection module 2 data-port 1 portfast enable

monitor session 2 destination intrusion-detection-module 2 data-port 1

Also it would be great if you explain the over all stuff in quick reference style:)

Farrukh Haroon Thu, 08/21/2008 - 19:14

The intrusion detection module is connected to the switch back plane via a 'hidden' link. Which can be seen by show ether channel tough. The IDSM in total has 8 ports. In your configuration the management/command&control port belongs to VLAN 333 (this is port gig 0/1 on the IDSM I think). This port is represented by 'management-port' in the IDSM config.

Ports gig x/7 and gig x/8 are the two 'sensing' ports. These are represented by 'data-port' 1 and 2 in the IDSM config. In you case all data from some interface(s)/vlan(s) is being sent to the 'first' sensing port of the IDSM. So in short you are using promiscuous mode. For more details on what traffic is being sent, have a look at the 'show monitor session' command.

Please rate if helpful.

Regards

Farrukh

Actions

This Discussion