08-19-2008 03:16 PM - edited 03-10-2019 04:15 AM
Which command on IDSM is used to check if the device is running on inline or promiscous mode?
08-19-2008 11:38 PM
You can see this both from the Cataylyst Switch configuration and the IDS itself.
In the 6500 switch if its inline VLAN pair you will form a trunk to the IDSM like this:
intrusion-detection port-channel 5 trunk allowed-vlan 130,140
If it is Inline Phyiscal interfae you will see something like:
intrusion-detection module 4 data-port 1 access-vlan
In case of promiscious you will have SPAN/capture configuration.
On the IDS cli you can see it via CLI:
physical-interfaces GigabitEthernet0/8
subinterface-type inline-vlan-pair
subinterface 7
vlan1 160
vlan2 760
This is an example of Inline VLAN Pair.
Regards
Farrukh
08-20-2008 01:10 PM
I can see
inline-interfaces test
no description
interface1 GigabitEthernet0/7
interface2 GigabitEthernet0/8
on CLI of IDSM which means it's in inline VLAN pair but however i can also see SPAN through monitor commands which means it's in promiscous mode. Which is correct?
08-20-2008 06:36 PM
No you IDS seems to be in 'Inline Interface Pair' mode and not Inline VLAN pair mode and definitely not in promiscuous mode. Those span settings must be for something else on the switch.
In IDM >> Virtual Sensor Configurationyou sill see it spelled out pretty clearly.
If possible post 'show run | inc intrusion' from your core switch.
Regards
Farrukh
08-21-2008 03:23 PM
Thanks Farrukh! I am sending the output here,
sh run | i intrusion
intrusion-detection module 2 management-port access-vlan 333
intrusion-detection module 2 data-port 1 autostate include
intrusion-detection module 2 data-port 1 portfast enable
monitor session 2 destination intrusion-detection-module 2 data-port 1
Also it would be great if you explain the over all stuff in quick reference style:)
08-21-2008 07:14 PM
The intrusion detection module is connected to the switch back plane via a 'hidden' link. Which can be seen by show ether channel tough. The IDSM in total has 8 ports. In your configuration the management/command&control port belongs to VLAN 333 (this is port gig 0/1 on the IDSM I think). This port is represented by 'management-port' in the IDSM config.
Ports gig x/7 and gig x/8 are the two 'sensing' ports. These are represented by 'data-port' 1 and 2 in the IDSM config. In you case all data from some interface(s)/vlan(s) is being sent to the 'first' sensing port of the IDSM. So in short you are using promiscuous mode. For more details on what traffic is being sent, have a look at the 'show monitor session' command.
Please rate if helpful.
Regards
Farrukh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide