IDSM

aksher · ‎08-19-2008

Which command on IDSM is used to check if the device is running on inline or promiscous mode?

Farrukh Haroon · ‎08-19-2008

You can see this both from the Cataylyst Switch configuration and the IDS itself.

In the 6500 switch if its inline VLAN pair you will form a trunk to the IDSM like this:

intrusion-detection port-channel 5 trunk allowed-vlan 130,140

If it is Inline Phyiscal interfae you will see something like:

intrusion-detection module 4 data-port 1 access-vlan

In case of promiscious you will have SPAN/capture configuration.

On the IDS cli you can see it via CLI:

physical-interfaces GigabitEthernet0/8

subinterface-type inline-vlan-pair

subinterface 7

vlan1 160

vlan2 760

This is an example of Inline VLAN Pair.

Regards

Farrukh

aksher · ‎08-20-2008

I can see

inline-interfaces test

no description

interface1 GigabitEthernet0/7

interface2 GigabitEthernet0/8

on CLI of IDSM which means it's in inline VLAN pair but however i can also see SPAN through monitor commands which means it's in promiscous mode. Which is correct?

Farrukh Haroon · ‎08-20-2008

No you IDS seems to be in 'Inline Interface Pair' mode and not Inline VLAN pair mode and definitely not in promiscuous mode. Those span settings must be for something else on the switch.

In IDM >> Virtual Sensor Configurationyou sill see it spelled out pretty clearly.

If possible post 'show run | inc intrusion' from your core switch.

Regards

Farrukh

aksher · ‎08-21-2008

Thanks Farrukh! I am sending the output here,

sh run | i intrusion

intrusion-detection module 2 management-port access-vlan 333

intrusion-detection module 2 data-port 1 autostate include

intrusion-detection module 2 data-port 1 portfast enable

monitor session 2 destination intrusion-detection-module 2 data-port 1

Also it would be great if you explain the over all stuff in quick reference style:)

Farrukh Haroon · ‎08-21-2008

The intrusion detection module is connected to the switch back plane via a 'hidden' link. Which can be seen by show ether channel tough. The IDSM in total has 8 ports. In your configuration the management/command&control port belongs to VLAN 333 (this is port gig 0/1 on the IDSM I think). This port is represented by 'management-port' in the IDSM config.

Ports gig x/7 and gig x/8 are the two 'sensing' ports. These are represented by 'data-port' 1 and 2 in the IDSM config. In you case all data from some interface(s)/vlan(s) is being sent to the 'first' sensing port of the IDSM. So in short you are using promiscuous mode. For more details on what traffic is being sent, have a look at the 'show monitor session' command.

Please rate if helpful.

Regards

Farrukh