Change IPS to IDS

fedecotofaja · ‎02-08-2009

Hi All,

I have an IPS Sensor 4240 working inline with the default settings... I need to do some tests and I need to change it to behave as an IDS. I know that I should configure the port on the swith as a SPAN port to send all traffic to the IDS (that will no longer be inline)....

My question is... what do I need to do in the IPS Sensor to change it to IDS?

Thank you all!

rhermes · ‎02-09-2009

The 4240 has 4 ports. One (in-line VLAN pairs) or two (in-line interface pairs) of those ports are being used. If you have a free port, put it in promiscious mode (default) and connect it to a new port on the switch that is aggregating your traffic. Configure the new switch interface as a span destination port. then disconnect your in-line interfaces (restoring traffic via another path of course).